#VU49158 Uncontrolled memory allocation in FactoryTalk Linx - CVE-2020-5806

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled memory allocation in RSLinxNG.exe. An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest function in messaging.dll. A local attacker can send a specially crafted LoadIconStream message to 127.0.0.1:7153 to cause the new operator to allocate a large amount of memory. It's been observed that a large allocation size (i.e., 0xffffffff) can cause an unhandled exception in RSLinxNG.exe, which results in process termination of RSLinxNG.exe.

A local user can perform a denial of service attack.

Remediation

External links

• https://www.tenable.com/security/research/tra-2020-71
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129496/redirect
• https://ics-cert.us-cert.gov/advisories/icsa-21-028-01