buglwIP - A Lightweight TCP/IP stack - Bugs: bug #60717, SNMPv3: Signed integer overflow...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60717: SNMPv3: Signed integer overflow after 68 years

Submitted by:  Tim Schendekehl <timschendekehl>
Submitted on:  Tue 01 Jun 2021 09:46:16 AM UTC  
 
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Tue 01 Jun 2021 09:46:16 AM UTC, original submission:  

Function snmp_parse_inbound_frame in file src/apps/snmp/snmp_msg.c contains a check for the engine time:
  if (request->msg_authoritative_engine_time > (time + 150)) {

After SNMP_MAX_TIME_BOOT seconds (68 years) the engine time will be reset to zero and the boot count will be increased. The last 150 seconds before that happens, there will be a signed integer overflow and SNMP packets will be rejected. Note that msg_authoritative_engine_time and time are signed 32-bit integers. Of course it is unlikely, that a device is running for so long without reboot.

Tim Schendekehl <timschendekehl>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by timschendekehl (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.7