Buffer Overflow Vulnerability in libmodbus: CVE-2024-34244
Summary
UBUNTU-CVE-2024-34244: libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. Affects libmodbus versions 3.0.4-1 – 3.0.5-1ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libmodbus is an open-source library that provides a simple and efficient way to implement the Modbus protocol, which is widely used in industrial automation and control systems. The library facilitates communication between devices over serial and TCP/IP networks. Its key attributes include support for Modbus RTU, Modbus ASCII, and Modbus TCP, making it versatile for various applications. However, a recent vulnerability has been identified that affects versions of libmodbus, potentially compromising the stability and security of applications that rely on it.
Vulnerability Detail
libmodbus v3.1.10 is vulnerable to a Buffer Overflow via the modbus_write_bits function. This vulnerability can be triggered when the function is supplied with specially crafted input, leading to an out-of-bounds read. The consequences of this vulnerability may include application crashes, unexpected behaviors, and potential exploitation by malicious actors, thereby posing a significant risk to systems using this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can validate the input to the modbus_write_bits function to ensure it does not exceed expected limits, thereby preventing the buffer overflow from occurring. Implementing strict input validation can mitigate the risk until the package is updated.
Conclusion
The buffer overflow vulnerability in libmodbus (CVE-2024-34244) poses significant risks to applications relying on this library. It is crucial for users to update to the latest patched versions to ensure the security and stability of their systems. Implementing input validation can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for libmodbus →
FAQ
CVE-2024-34244 is a unique identifier for a specific vulnerability in the libmodbus library that allows for a buffer overflow, potentially leading to application crashes or exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability could lead to application crashes, unexpected behaviors, and exploitation by attackers, which may compromise the security of systems utilizing the libmodbus library.
Yes, a patched version of libmodbus is available. Users should update to version 3.1.11-2 or later to mitigate the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for libmodbus.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
