Bug 1223697 (CVE-2023-26793)

Summary:	VUL-0: CVE-2023-26793: libmodbus: heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Security	Assignee:	Stanislav Brabec <sbrabec>
Status:	CONFIRMED ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	andrea.mattiazzo
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/403923/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-05-02 10:50:03 UTC

libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26793
https://www.cve.org/CVERecord?id=CVE-2023-26793
https://github.com/stephane/libmodbus/issues/683

Comment 1 Andrea Mattiazzo 2024-05-02 10:50:54 UTC

No information upstream

Tracking as affected:
- openSUSE:Backports:SLE-15-SP5/libmodbus    3.1.10
- openSUSE:Backports:SLE-15-SP6/libmodbus    3.1.10
- openSUSE:Factory/libmodbus                 3.1.10

Comment 2 Stanislav Brabec 2024-05-06 16:06:56 UTC

However it is more than a year old report, there is apparently no fix yet.

https://nvd.nist.gov/vuln/detail/CVE-2023-26793
This vulnerability is currently awaiting analysis.

Comment 3 Stanislav Brabec 2024-06-11 22:17:50 UTC

Checking the upstream, there is no fix. The upstream issue has no progress.

Is it serious enough to start a research? Note that we have no Modbus testing hardware.