#VU49157 Uncontrolled memory allocation in FactoryTalk Linx - CVE-2020-5802

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncontrolled memory allocation in RSLinxNG.exe. An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP prot 4241. This will cause the new operator to allocate a large amount of memory. It's been observed that a large allocation size (i.e., 0xfffffff3) can cause an unhandled exception in RSLinxNG.exe, which results in process termination of RSLinxNG.exe.

A remote non-authenticated attacker can send a malformed request and crash the RSLinxNG.exe service.

Remediation

External links

• https://www.tenable.com/security/research/tra-2020-71
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129496/redirect
• https://ics-cert.us-cert.gov/advisories/icsa-21-028-01