One unauthenticated packet crashes TDengine, the database behind factory and EV telemetry

The chain is short. taosd, the TDengine server, speaks a custom binary RPC protocol on TCP port 6030 by default, and every message opens with a fixed header called STransMsgHead that carries a length field, msgLen. ^[5] Before any authentication runs, the server calls uvConnMayGetUserInfo() to read the user identity out of the inbound message, and to find the payload it subtracts the header size from msgLen. ^[6]

msgLen is a signed 32-bit integer taken straight from the attacker. The header size is an unsigned size_t. C promotes the signed value to unsigned, so when msgLen is smaller than the required offset, either 64 or 192 bytes depending on the message variant, the subtraction does not go negative. It wraps to a value near 2^64 on a 64-bit host. ^[7] That number is then handed to memcpy() as a length, memcpy runs off the end of the heap allocation, and the process exits with a segmentation fault. ^[8]

An attacker needs no credentials and no valid session to send that packet. ^[9] Ridge Security describes a crash, not code execution: taosd dies and the database goes down. ^[8] The CVSS score of 7.5 reflects a network-reachable availability hit, and the account comes from the team that found the bug and reported it to the maintainers. ^[3][2]

The fix is about three lines. Validate that the message length is at least the header plus the offset before doing any arithmetic on it, a check that now sits at the top of uvConnMayGetUserInfo() in 3.4.1.6. ^[11] Versions 3.4.0.0 through 3.4.1.5 need it, and Ridge Security's other instruction is to keep port 6030 off any network that does not need to reach it. ^[4][10]

Integer underflow in a length calculation is one of the oldest bug classes there is. It survives because length minus header size is not a line that stands out in review; it becomes a vulnerability only when a signed, attacker-controlled operand meets an unsigned one. ^[12] The parsing runs before authentication because it has to. The server reads the credentials out of the packet before it can verify them, so the length check has to be right at the first byte. ^[13]

TDengine sits behind SCADA systems, EV charging networks, building automation and telecom monitoring, ingesting large volumes of machine data. It is internal plumbing, so it tends to be installed once and left alone. ^[14]