CVE-2025-30216
Published: 25 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-30216 is a heap overflow vulnerability affecting CryptoLib versions 1.3.3 and prior, a software library that implements the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for securing communications between spacecraft running NASA's core Flight System (cFS) and ground stations. The flaw occurs in the `Crypto_TM_ProcessSecurity` function at `crypto_tm.c:1735:8`, where processing the Secondary Header Length of a TM protocol packet—if it exceeds the packet's total length—triggers an unsafe memcpy operation into the dynamically allocated buffer `p_new_dec_frame`. This enables overwriting of adjacent heap memory. The vulnerability carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) and is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).
An unauthenticated attacker with network access can exploit this vulnerability by sending a specially crafted TM protocol packet to a vulnerable ground station or spacecraft system. Low attack complexity and no user interaction are required, allowing remote exploitation over the network. Successful exploitation enables heap memory corruption, potentially resulting in arbitrary code execution or system instability.
Mitigation is available via a patch in CryptoLib commit 810fd66d592c883125272fef123c3240db2f170f. Further details, including the advisory, are provided in the GitHub Security Advisory at GHSA-v3jc-5j74-hcjv.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Remote unauthenticated heap overflow in network packet processing function enables crafted packet exploitation of the public-facing service for arbitrary code execution.