CryptoLib vulnerabilities

CryptoLib before version 1.4.3 contains a heap buffer overflow vulnerability when decoding Base64 fields in JSON responses from the KMC service. The destination buffer is sized based on expected output length, but the Base64 decoder writes based on actual input length, allowing out-of-bounds writes.

CryptoLib before version 1.4.3 contains a vulnerability in the write_callback function of the KMC crypto service client, which does not limit the size of HTTP response buffers. A malicious KMC server can send an arbitrarily large response, causing unbounded memory growth and process termination by the OS.

CryptoLib prior to version 1.4.3 contains an out-of-bounds heap read vulnerability in the cryptography_aead_encrypt() function. The issue has been fixed in version 1.4.3.

CryptoLib before version 1.4.3 contains a vulnerability involving memory read without proper bounds checking when parsing AOS frame hashes. The issue has been fixed in version 1.4.3.

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3.