harfbuzz:hb-draw-fuzzer: Global-buffer-overflow in OT::VarData::get_scalars

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6231698648596480 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Global-buffer-overflow WRITE 4 Crash Address...

NSA Urgently Warns on Industrial Cyberattacks, Triconex Critical Bug

The U.S. National Security Agency NSA and the Cybersecurity and Infrastructure Security Agency CISA have issued an alert warning that adversaries could be targeting critical infrastructure across the U.S. Separately, ICS-CERT issued an advisory on a critical security bug in the Schneider Electric...

Unique Threats to Operational Technology and Cyber Physical Systems

In this latest episode of our Eye on Security podcast, I talk all about the world of operational technology OT and cyber physical systems with one of our foremost experts on the topic: Nathan Brubaker, Senior Manager of Analysis for Mandiant Threat Intelligence. Nathan kicked off our chat by...

OSV-2020-732 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13537 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-728 Stack-buffer-overflow in ot::Ip6::OptionPadN::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14854 Crash type: Stack-buffer-overflow WRITE 9 Crash state: ot::Ip6::OptionPadN::Init ot::Ip6::Ip6::RemoveMplOption ot::Ip6::Ip6::ProcessReceiveCallback...

OSV-2020-700 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15380 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-670 Memcpy-param-overlap in ot::Cli::CoapSecure::Process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12679 Crash type: Memcpy-param-overlap Crash state: ot::Cli::CoapSecure::Process ot::Cli::Interpreter::ProcessCoapSecure ot::Cli::Interpreter::ProcessLine...

OSV-2020-638 Heap-buffer-overflow in OT::UnsizedArrayOf<OT::IntType<unsigned char, 1u> >::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14637 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::UnsizedArrayOf ::copy bool OT::OffsetTo , OT::IntTy OT::NameRecord::copy...

OSV-2020-640 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15447 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::AddressResolver::SendAddressQueryResponse...

OSV-2020-608 UNKNOWN READ in ot::Ip6::Address::PrefixMatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13349 Crash type: UNKNOWN READ Crash state: ot::Ip6::Address::PrefixMatch ot::Dhcp6::Dhcp6Server::RemovePrefixAgent ot::Dhcp6::Dhcp6Server::UpdateService...

OSV-2020-598 UNKNOWN READ in ot::Message::GetPriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13380 Crash type: UNKNOWN READ Crash state: ot::Message::GetPriority ot::PriorityQueue::RemoveFromList ot::PriorityQueue::Dequeue...

OSV-2020-596 UNKNOWN READ in ot::PriorityQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13388 Crash type: UNKNOWN READ Crash state: ot::PriorityQueue::GetHead ot::Ip6::Ip6::HandleSendQueue ot::TaskletScheduler::ProcessQueuedTasklets...

OSV-2020-597 UNKNOWN READ in ot::MessageQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13386 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetHead ot::Coap::CoapBase::ClearRequestsAndResponses ot::Coap::CoapSecure::Stop...

OSV-2020-565 Use-of-uninitialized-value in OT::AxisValue::sanitize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14850 Crash type: Use-of-uninitialized-value Crash state: OT::AxisValue::sanitize bool OT::OffsetTo, true::sanitiz bool OT::UnsizedArrayOfOT::OffsetToOT::AxisValue, OT::IntTypeunsigned short,...

OSV-2020-528 Stack-buffer-overflow in ot::Message::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17330 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Message::Read ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-531 Stack-buffer-overflow in ot::MeshCoP::DatasetManager::HandleSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15374 Crash type: Stack-buffer-overflow READ 15 Crash state: ot::MeshCoP::DatasetManager::HandleSet ot::MeshCoP::ActiveDataset::HandleSet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-496 Stack-buffer-overflow in ot::Mle::Mle::HandleParentResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15382 Crash type: Stack-buffer-overflow READ Crash state: ot::Mle::Mle::HandleParentResponse ot::Mle::Mle::HandleUdpReceive ot::Ip6::Udp::HandleMessage...

OSV-2020-468 Stack-buffer-overflow in ot::Ip6::Address::FromString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14821 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ot::Ip6::Address::FromString ot::Cli::Coap::ProcessRequest ot::Cli::Interpreter::ProcessCoap...

OSV-2020-413 Stack-buffer-overflow in ot::NetworkData::NetworkDataTlv::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14401 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::NetworkDataTlv::GetNext ot::NetworkData::Leader::IsStableUpdated ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-396 UNKNOWN READ in ot::TaskletScheduler::PopTasklet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13370 Crash type: UNKNOWN READ Crash state: ot::TaskletScheduler::PopTasklet ot::TaskletScheduler::ProcessQueuedTasklets radioreceivedone.cpp...