RT-Labs P-Net vulnerabilities

Resource exhaustion from RPC sessions kept for requests to unknown interface

RT-Labs · P-Net

Alarm data length not validated against received frame length

RT-Labs · P-Net

Out-of-bounds read of DCP block header in DCP Set and Identify request parsing

RT-Labs · P-Net

NULL pointer dereference on implicit read of user specific record index

RT-Labs · P-Net

Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness

RT-Labs · P-Net

Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()

RT-Labs · P-Net

Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()

RT-Labs · P-Net

NULL pointer dereference on implicit read of AR specific record index

RT-Labs · P-Net

Out-of-bounds write when parsing AR Vendor Block requests

RT-Labs · P-Net

Infinite loop when reading PDPortDataCheck record of subslot 0

RT-Labs · P-Net