Summary
A PROFINET IO device built on p-net can be memory-corrupted by an unauthenticated IODWrite request carrying a PDPortDataCheck / CheckPeers block with an oversized peer-name length. get_check_peer reads a 1-byte length_peer_port_name / length_peer_station_name (0–255) from the wire and copies that many attacker-supplied bytes into fixed-size struct fields (peer_port_name[15], peer_station_name[241]) using the shared pf_get_mem primitive — which validates only the source buffer, never the destination capacity. The result is an out-of-bounds write of up to 240 bytes (port-name case) with fully attacker-controlled content, plus a trailing NUL up to offset 255 — a controlled write primitive, not just a crash. The source even carries the developers' own /* TODO: Validate length_peer_port_name and length_peer_station_name */.
- Affected Version & Scope
Repository / product: p-net — https://github.com/rtlabs-com/p-net
Pinned commit / firmware build: ca4f37c (2026-06-23)
Affected range (if known): HEAD ca4f37c and earlier; not fixed at HEAD (a TODO acknowledges the missing validation).
Build/config preconditions: default PROFINET IO device build; the bug is in parsing an IODWrite record, reachable on any device that accepts PDPortDataCheck records.
Summary
A PROFINET IO device built on p-net can be memory-corrupted by an unauthenticated IODWrite request carrying a PDPortDataCheck / CheckPeers block with an oversized peer-name length. get_check_peer reads a 1-byte length_peer_port_name / length_peer_station_name (0–255) from the wire and copies that many attacker-supplied bytes into fixed-size struct fields (peer_port_name[15], peer_station_name[241]) using the shared pf_get_mem primitive — which validates only the source buffer, never the destination capacity. The result is an out-of-bounds write of up to 240 bytes (port-name case) with fully attacker-controlled content, plus a trailing NUL up to offset 255 — a controlled write primitive, not just a crash. The source even carries the developers' own /* TODO: Validate length_peer_port_name and length_peer_station_name */.
Repository / product: p-net — https://github.com/rtlabs-com/p-net
Pinned commit / firmware build: ca4f37c (2026-06-23)
Affected range (if known): HEAD ca4f37c and earlier; not fixed at HEAD (a TODO acknowledges the missing validation).
Build/config preconditions: default PROFINET IO device build; the bug is in parsing an IODWrite record, reachable on any device that accepts PDPortDataCheck records.