Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states an 'off-by-one global buffer overflow in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c)'. It specifies that 'The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.' Upon reviewing the provided source code for demo/LINUXTCP/port/porttcp.c, the xMBPortTCPPool function indeed contains the line if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE). This check is intended to prevent oversized Modbus TCP frames. However, if usTCPFrameBytesLeft is exactly equal to MB_TCP_BUF_SIZE, this condition evaluates to false, and the code proceeds to call recv. The recv function then attempts to write usTCPFrameBytesLeft (which is MB_TCP_BUF_SIZE) bytes into the aucTCPBuf buffer starting at aucTCPBuf[usTCPBufPos]. Since aucTCPBuf has a size of MB_TCP_BUF_SIZE, if usTCPBufPos is greater than 0 (meaning some data has already been received into the buffer), writing MB_TCP_BUF_SIZE more bytes will cause a buffer overflow. This allows an attacker to write past the allocated memory for aucTCPBuf, leading to potential denial of service or arbitrary code execution.
xMBPortTCPPooldemo/LINUXTCP/port/porttcp.c