Critical Flaws Affect Embedded TCP/IP Stack Widely Used in Industrial Control Devices

Cybersecurity researchers on Wednesday disclosed 14
vulnerabilities affecting a commonly-used TCP/IP stack used in
millions of Operational Technology (OT) devices manufactured by no
fewer than 200 vendors and deployed in manufacturing plants, power
generation, water treatment, and critical infrastructure
sectors.

The shortcomings, collectively dubbed “INFRA:HALT,” target
NicheStack, potentially enabling an attacker to achieve remote code
execution, denial of service, information leak, TCP spoofing, and
even DNS cache poisoning.

NicheStack (aka InterNiche stack) is a closed-source TCP/IP
stack for embedded systems that is designed to provide internet
connectivity industrial equipment, and is incorporated by major
industrial automation vendors like Siemens, Emerson, Honeywell,
Mitsubishi Electric, Rockwell Automation, and Schneider Electric in
their programmable logic controllers (PLCs) and other products.

“Attackers could disrupt a building’s HVAC system or take over
the controllers used in manufacturing and other critical
infrastructure,” researchers from JFrog^[1]
and Forescout^[2]
said in a joint report published today. “Successful attacks can
result in taking OT and ICS devices offline and having their logic
hijacked. Hijacked devices can spread malware to where they
communicate on the network.”

All versions of NicheStack before version 4.3 are vulnerable to
INFRA:HALT, with approximately 6,400 OT devices exposed online and
connected to the internet as of March 2021, most of which are
located in Canada, the U.S., Spain, Sweden, and Italy.

The list of 14 flaws is as follows –

• CVE-2020-25928 (CVSS score: 9.8) – An out-of-bounds read/write
  when parsing DNS responses, leading to remote code execution
• CVE-2021-31226 (CVSS score: 9.1) – A heap buffer overflow flaw
  when parsing HTTP post requests, leading to remote code
  execution
• CVE-2020-25927 (CVSS score: 8.2) – An out-of-bounds read when
  parsing DNS responses, leading to denial-of-service
• CVE-2020-25767 (CVSS score: 7.5) – An out-of-bounds read when
  parsing DNS domain names, leading to denial-of-service and
  information disclosure
• CVE-2021-31227 (CVSS score: 7.5) – A heap buffer overflow flaw
  when parsing HTTP post requests, leading to denial-of-service
• CVE-2021-31400 (CVSS score: 7.5) – An infinite loop scenario in
  the TCP out of band urgent data processing function, causing a
  denial-of-service
• CVE-2021-31401 (CVSS score: 7.5) – An integer overflow flaw in
  the TCP header processing code
• CVE-2020-35683 (CVSS score: 7.5) – An out-of-bounds read when
  parsing ICMP packets, leading to denial-of-service
• CVE-2020-35684 (CVSS score: 7.5) – An out-of-bounds read when
  parsing TCP packets, leading to denial-of-service
• CVE-2020-35685 (CVSS score: 7.5) – Predictable initial sequence
  numbers (ISNs) in TCP connections, leading to TCP spoofing^[3]
• CVE-2021-27565 (CVSS score: 7.5) – A denial-of-service
  condition upon receiving an unknown HTTP request
• CVE-2021-36762 (CVSS score: 7.5) – An out-of-bounds read in the
  TFTP packet processing function, leading to denial-of-service
• CVE-2020-25926 (CVSS score: 4.0) – The DNS client does not set
  sufficiently random transaction IDs, causing cache poisoning
• CVE-2021-31228 (CVSS score: 4.0) – The source port of DNS
  queries can be predicted to send forged DNS response packets,
  causing cache poisoning

The disclosures mark the sixth time security weaknesses have
been identified in the protocol stacks that underpin millions of
internet-connected devices. It’s also the fourth set of bugs to be
uncovered as part of a systematic research study called Project
Memoria to study the security of widely-used TCP/IP stacks that are
incorporated by various vendors in their firmware to offer internet
and network connectivity features –

HCC Embedded, which maintains the C library, has released software patches^[4] to address the issues.
“Complete protection against INFRA:HALT requires patching
vulnerable devices but is challenging due to supply chain logistics
and the critical nature of OT devices,” the researchers said.

As mitigations, Forescout has released an open-source script^[5]
that uses active fingerprinting to detect devices running
NicheStack. It’s also recommended to enforce segmentation controls,
monitor all network traffic for malicious packets to mitigate the
risk from vulnerable devices.