Security1 publisher3 min readPublished
libiec61850 1.6.2 patches a stack overflow an MMS client can reach with one write request
The maintenance release for the 1.6 branch carries seven fixes with GitHub advisory IDs and six that involve memory corruption. It also lets a running IEC 61850 server take a new TLS configuration.
The Watch · Security desk
What happened
- Seven of the fixes listed in the notes carry GitHub Security Advisory identifiers, spanning the MMS server, IED client code and the association handshake.
- In the sampled-values subscriber, the null terminator for svId and datSet was overwriting the tag and could cause an out-of-bounds write.
- IedServer and IedConnection now accept a TLS configuration update while running, with the new configuration applied to connections opened after the change.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The sampled-values subscriber consumes raw Ethernet frames, so its out-of-bounds write is reachable by anything able to put a crafted frame on the process bus segment, with no MMS association involved.
- capability Certificate and ciphersuite changes on an IEC 61850 server can be made without stopping the service, so a rotation no longer has to wait for a scheduled outage.
- decision Sites running R-Session on the default 65000-byte payload buffers can put that fix behind the MMS server ones when sequencing the rebuild.
- constraint Scanners keyed to CVE feeds will not flag unpatched 1.6.x builds, so asset owners have to ask vendors which library version their IEDs and gateways ship.
Exploitability ranking starts inside the MMS server. A write request using component alternate access could overflow the stack-allocated nameIdStr variable [14]. Updating a report control block that used another connection's association-specific dataset could produce a heap use-after-free [13]. The ObtainFile service double-freed a stale file handle [18], and an oversized RptID written to an RCB triggered an invalid free once reports were sent [16]. Add the two out-of-bounds writes and six fixes in this release involve memory corruption [5].
The rest of the advisory set is crash material, starting with the four of seven GitHub advisories that are NULL pointer dereferences [3]: writing into an array element component of an array of basic type [9], a structured sub-access path through MmsVariableSpecification_getNamedVariableRecursive [10], and two in client code that a server's response triggers, namely IedConnection_getFileDirectory when the server answers moreFollows=true with no directory entries [11] and a malformed LastApplError message [12][2]. A station gateway pulling files off an IED is the exposed party in those two. The remaining advisories cover an infinite loop in ACSE parseUserInformation on a malformed AARE PDU [15] and a crash in the access control check handler for association and VMD specific datasets [17]. Missing checks in MmsMapping_varAccessSpecToObjectReference allowed out-of-bounds reads [8].
The sampled-values path is frame-driven: the library now accepts raw Ethernet frames through SVReceiver_handleL2Message [28], and in the subscriber the null terminator for svId and datSet was overwriting the tag field, which could cause an out-of-bounds write [20]. A further fix adds the length validation that some ASDU elements lacked before the application read them [21].
Two items are irrelevant to most deployments. The R-Session out-of-bounds write needs payload buffers configured above the 65000-byte default with encryption or authentication enabled [23]. The new LIB61850_ENABLE_TEST_API build option is off by default, and when it is on it exports a function that injects artificial delays before MMS file read responses; production builds are unaffected while it stays off [27].
IedServer and IedConnection can now take a new TLS configuration while running, and it applies only to connections opened after the change [3]. The mbedtls 2.28 and 3.6 integrations were reworked to produce more standard-compliant events [5], with further TLS changes merged from lib60870 [6]. The upgrade takes code work: IsoConnectionParameters_setTlsConfiguration has been removed because TLSConfiguration is no longer stored in IsoConnectionParameters [4], so integration code calling it will not build against 1.6.2.
Anyone who wants to track this release has to follow the maintainer's numbering. The notes number the fixes with the project's own LIB61850 tickets and GitHub advisory IDs [33], and describe 1.6.2 as a maintenance release for version 1.6 containing vulnerability and bug fixes, of which "It is highly recommended to update to this release" [1][2].
What to watch
- Whether CVE identifiers are assigned to the seven GHSA advisories, which would put unpatched 1.6.x builds into scanner feeds.
- Vendor advisories from IED and gateway makers embedding libiec61850, naming which products carry 1.6.2 or later.
- Whether a public proof of concept appears for the SV subscriber out-of-bounds write, given the frame-driven reachability.