Memory corruption vulnerabilities in open62541 library enable remote code execution and service disruption

Summary

The open62541 library, used for OPC UA implementations, contains several critical vulnerabilities related to improper integer handling. These flaws can be triggered by specially crafted network packets, potentially allowing an attacker to read or write memory outside of intended bounds. Depending on the specific vulnerability exploited, this could result in a full service crash or the execution of unauthorized code.

Technical details

The identified vulnerabilities stem from insufficient validation of size and dimension values during data processing.

One significant flaw involves an integer overflow within the UA_Variant array dimensions computation. When multiplying attacker-controlled values into a size_t accumulator, the product can wrap around to match a much smaller arrayLength. This mismatch allows subsequent read or write operations to access memory outside of the allocated buffer bounds.

Another critical issue is a heap use-after-free vulnerability located in the TransferSubscriptions service. An authenticated attacker can exploit this flaw to cause a denial of service or potentially execute arbitrary code.

Additionally, an unsigned integer underflow exists within the PubSub signature verification path. If a packet's length is smaller than the expected signature size, the subtraction wraps around to produce a large size_t value. This causes the underlying mbedtls library to attempt reading unmapped memory, leading to a crash.

Affected products and fixed versions

Why this matters for defenders

For those running industrial automation or systems relying on the open62541 implementation, these vulnerabilities represent a direct path to system instability. An attacker capable of sending crafted UDP packets or interacting with the TransferSubscriptions service can disrupt operations by crashing the service.

The potential for out-of-bounds memory access means that an attacker might move beyond simple disruption to gaining control over the application's execution flow. Because these flaws are triggered via network communication, they pose a significant risk to any exposed or reachable service.

Defender guidance

Immediate action is required to secure environments using affected versions of open62541.

• Apply Patches: Review your current library versions and apply the fixes provided in the official repository commits. The patches introduce checked multiplication for dimension computations and mandatory bounds checks during signature verification.
• Validate Input Sizes: Ensure that any network-facing service implementing this library validates packet lengths against expected signature sizes before performing arithmetic operations on those lengths.
• Monitor Service Stability: Watch for unexpected service restarts or crashes in your industrial control environments, which may indicate attempted exploitation of the heap use-after-free or integer underflow flaws.