The Patching Friars' AlmanacA calendar of CVE saints

August 4

INFRA:HALTHoly card for infra-halt, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 HALT INFRA:HALT SISTE VIATOR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint INFRA:HALT, Who Stopped the Factories

Patron of embedded TCP/IP stacks, overlong DNS responses, and plants nobody dares to reboot.

Life

On 4 August 2021 Forescout and JFrog revealed fourteen vulnerabilities in NicheStack, a TCP/IP stack hidden in thousands of industrial devices. A well-crafted DNS response or a malicious HTTP request was enough to run code or freeze the device: hence the name, which is an order to stop. It belonged to Project Memoria, the long procession of bugs in network stacks.

Prayer

O Saint INFRA:HALT, who stops machinery with a single packet, let our PLCs read every DNS response to the last byte and no further. Amen.

How to celebrate

Celebrated by upgrading NicheStack to 4.3 and segmenting the OT network, ideally before the next plant shutdown.

Wrong packet, stopped line.

Technical record

Disclosed on
August 4 2021
CVE
CVE-2020-25928CVE-2021-31226

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall(), getoffset(), dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the "response data length" field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context.

Sources: forescout.com · forescout.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.