CVE-2021-29998: VxWorks DHCP Buffer Overflow Vulnerability

CVE-2021-29998 Overview

CVE-2021-29998 is a heap overflow vulnerability discovered in Wind River VxWorks, a widely-deployed real-time operating system (RTOS) used in industrial control systems, medical devices, aerospace systems, and networking equipment. The vulnerability exists in the DHCP client component of VxWorks versions prior to 6.5, allowing remote attackers to potentially execute arbitrary code or cause denial of service conditions on affected devices.

This vulnerability is particularly concerning due to the widespread deployment of VxWorks in critical infrastructure and industrial environments. The DHCP client flaw can be exploited by an attacker who can send malicious DHCP responses to vulnerable devices on the same network segment, making it a significant threat to operational technology (OT) environments.

Critical Impact

Remote attackers can exploit the heap overflow in the DHCP client to achieve arbitrary code execution or cause system crashes on critical infrastructure devices running VxWorks, potentially disrupting industrial operations and safety systems.

Affected Products

• Wind River VxWorks (versions prior to 6.5)
• Siemens SCALANCE X-series industrial Ethernet switches (multiple models including X200, X201, X202, X204, X206, X208, X212, X216, X224, X300, X408, XF201, XF202, XF204, XF206, XF208)
• Siemens RUGGEDCOM WIN Subscriber Station
• Siemens SIMATIC RF 181 EIP and RF 182C RFID readers
• Siemens SINAMICS Perfect Harmony GH180 drives

Discovery Timeline

• 2021-04-13 - CVE-2021-29998 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29998

Vulnerability Analysis

The vulnerability resides in the DHCP client implementation within VxWorks RTOS. When the DHCP client processes incoming DHCP responses, it fails to properly validate the size of certain fields before copying data into heap-allocated buffers. This improper bounds checking allows an attacker to craft malicious DHCP packets that overflow the heap buffer, corrupting adjacent memory structures.

In embedded and RTOS environments like VxWorks, heap overflows can be particularly dangerous as they may allow attackers to overwrite function pointers, control structures, or other critical data. Given that VxWorks is used in safety-critical systems, successful exploitation could have severe consequences ranging from device crashes to complete system compromise.

The vulnerability is classified as CWE-787 (Out-of-bounds Write), which describes the condition where software writes data past the end, or before the beginning, of the intended buffer.

Root Cause

The root cause is insufficient validation of DHCP option field lengths in the VxWorks DHCP client implementation. When processing DHCP OFFER or DHCP ACK messages from a server, the client allocates heap memory based on expected field sizes but fails to verify that incoming data conforms to these boundaries before copying. This allows oversized DHCP options to overflow the allocated heap buffer.

Attack Vector

The attack requires network access to the same broadcast domain as the target device. An attacker can exploit this vulnerability by:

1. Positioning themselves on the same network segment as a vulnerable VxWorks device
2. Setting up a rogue DHCP server or using ARP spoofing to intercept legitimate DHCP traffic
3. Sending crafted DHCP responses containing oversized option fields
4. Triggering the heap overflow when the vulnerable DHCP client processes the malicious response

The attack can be executed during device boot when it requests a DHCP lease, or when an existing lease expires and the device attempts to renew. In industrial environments, this could be triggered by restarting network equipment or during planned maintenance windows.

Since the vulnerability is in the DHCP client, it requires no authentication and can be exploited remotely over the network. The attacker needs to be able to send DHCP packets to the target, which typically means being on the same Layer 2 network segment or having control of network infrastructure.

Detection Methods for CVE-2021-29998

Indicators of Compromise

• Unexpected DHCP traffic from unauthorized sources on industrial network segments
• Unusual DHCP packets with abnormally large option fields or malformed structures
• Device crashes or reboots coinciding with DHCP lease renewal periods
• Memory corruption errors or unexpected behavior on VxWorks-based devices

Detection Strategies

• Deploy network intrusion detection systems (NIDS) to monitor for malformed DHCP packets with anomalous option lengths
• Implement deep packet inspection on network segments containing VxWorks devices to identify suspicious DHCP server responses
• Configure DHCP snooping on managed switches to prevent rogue DHCP servers from responding to clients
• Monitor device logs and health telemetry for unexpected reboots or memory-related errors

Monitoring Recommendations

• Establish baseline DHCP traffic patterns and alert on deviations in industrial OT networks
• Implement continuous monitoring of firmware versions across all VxWorks-based devices in the environment
• Deploy SentinelOne Singularity for IoT/OT visibility into embedded device behavior and network anomalies
• Configure centralized logging for all network infrastructure events, particularly DHCP-related activities

How to Mitigate CVE-2021-29998

Immediate Actions Required

• Conduct an asset inventory to identify all VxWorks-based devices running versions prior to 6.5
• Apply vendor firmware updates from Wind River and affected device manufacturers such as Siemens as soon as available
• Implement network segmentation to isolate vulnerable devices from untrusted network segments
• Enable DHCP snooping and port security on network switches to prevent rogue DHCP server attacks
• Consider using static IP addressing for critical infrastructure devices where DHCP is not essential

Patch Information

Wind River has released security updates addressing this vulnerability. Organizations should consult the Wind River Security Notices for VxWorks-specific patches. For Siemens industrial equipment, refer to Siemens Security Advisory SSA-560465 and Siemens Security Advisory SSA-910883 for firmware updates for affected SCALANCE, RUGGEDCOM, SIMATIC, and SINAMICS products. Additionally, CISA has published ICSA-21-194-12 Advisory with coordinated guidance for industrial control system operators.

Workarounds

• Configure static IP addresses on critical VxWorks devices to eliminate dependency on DHCP
• Implement strict network segmentation using VLANs and firewalls to isolate industrial devices from potential attackers
• Enable DHCP snooping on all managed switches to ensure only authorized DHCP servers can respond to client requests
• Deploy network access control (NAC) solutions to prevent unauthorized devices from connecting to sensitive network segments

# Example: Enable DHCP snooping on Cisco switches to mitigate rogue DHCP attacks
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 100
interface GigabitEthernet0/1
  description Trusted DHCP Server Port
  ip dhcp snooping trust
interface range GigabitEthernet0/2-24
  description Untrusted Client Ports
  ip dhcp snooping limit rate 10
end
write memory