The Patching Friars' AlmanacA calendar of CVE saints

August 3

CodeChismHoly card for codechism, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 CodeChism CREDO IN UNUM PLC
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint CodeChism, Catechism of the PLCs

Patron of industrial controllers, ladder logic programs, and vulnerabilities named reluctantly.

Life

In August 2023 K. Reid Wightman showed that in CODESYS Control, the runtime that drives a great many PLCs, a user allowed to upload programs could abuse a buffer overflow to break out of the control logic and take over the whole device. He admitted he chose the name only because a vulnerability is supposed to have one; but it sounds like catechism, and a saint of PLCs could ask for nothing better.

Prayer

O Saint CodeChism, who teaches PLCs doctrines not found in the manual, keep our programs within the bounds of their memory. Amen.

How to celebrate

Celebrated by updating CODESYS Control per advisory 2023-04 and reciting IEC 61131-3 by heart.

Upload the program, convert the controller.

Technical record

Disclosed on
August 3 2023
CVE
CVE-2022-4046CVE-2023-28355
CVSS
8.8
Product
CODESYS · CODESYS Control for BeagleBone SL

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.

Sources: infosec.exchange · api-de.codesys.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.