Summary

When processing security parameters in an SNMPv3 request, the client can perform an Out-of-Bounds (OOB) read beyond the allocated buffer. This occurs due to the absence of buffer length checks before parsing the security parameters.

Details

In the function _nx_snmp_version_3_process, located in nxd_snmp.c, the client typically uses _nx_snmp_utility_ functions to parse various fields, and those utility functions include internal checks on the remaining buffer length before proceeding. However, before parsing the security parameters, the code directly accesses the buffer (buffer_ptr) without validating the remaining buffer length, which can lead to an OOB read if the buffer_length is too short (which is 0 or 1).

file: nxd_snmp.c:18591
function: _nx_snmp_version_3_process

    ...

    /* Position to the next field.  */
    buffer_ptr =  buffer_ptr + length;

    /* The buffer pointer is moved by the length. Update buffer size */
    buffer_length -= (INT)length;

    /**** Now we are positioned in front of the security parameters field.  ****/

    /* It accesses buffer_ptr before checking remaining buffer_length */

    /* Determine if there are security parameters.  */
    if ((buffer_ptr[0] == NX_SNMP_ANS1_OCTET_STRING) && (buffer_ptr[1]))
    {

        /* Position the buffer pointer past the octet string.  */
        buffer_ptr =  buffer_ptr + 2;

    ...

In the above code, the buffer pointer is incremented, but no checks are performed on buffer_length before accessing buffer_ptr[0] and buffer_ptr[1]. This can lead to a situation where the pointer accesses memory outside the valid buffer range, especially when processing a malicious SNMPv3 request that contains malformed or truncated security parameters.

Impact

Exploiting this vulnerability could result in system instability, including crashes or memory corruption.