Skip to content

Unauthenticated OOB write in p-net get_check_peer (PROFINET PDPortDataCheck/CheckPeers) — p-net @ ca4f37c #600

Description

@entropy1337

Summary
A PROFINET IO device built on p-net can be memory-corrupted by an unauthenticated IODWrite request carrying a PDPortDataCheck / CheckPeers block with an oversized peer-name length. get_check_peer reads a 1-byte length_peer_port_name / length_peer_station_name (0–255) from the wire and copies that many attacker-supplied bytes into fixed-size struct fields (peer_port_name[15], peer_station_name[241]) using the shared pf_get_mem primitive — which validates only the source buffer, never the destination capacity. The result is an out-of-bounds write of up to 240 bytes (port-name case) with fully attacker-controlled content, plus a trailing NUL up to offset 255 — a controlled write primitive, not just a crash. The source even carries the developers' own /* TODO: Validate length_peer_port_name and length_peer_station_name */.

  1. Affected Version & Scope
    Repository / product: p-net — https://github.com/rtlabs-com/p-net
    Pinned commit / firmware build: ca4f37c (2026-06-23)
    Affected range (if known): HEAD ca4f37c and earlier; not fixed at HEAD (a TODO acknowledges the missing validation).
    Build/config preconditions: default PROFINET IO device build; the bug is in parsing an IODWrite record, reachable on any device that accepts PDPortDataCheck records.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions