CVE-2024-41660: slpd-lite Buffer Overflow Vulnerability

CVE-2024-41660 Overview

CVE-2024-41660 is a critical buffer overflow vulnerability in slpd-lite, a unicast SLP (Service Location Protocol) UDP server used in OpenBMC systems. Any OpenBMC system that includes the slpd-lite package is impacted, and installing this package is the default when building OpenBMC. The vulnerability allows remote attackers to send specially crafted SLP packets to the BMC via UDP port 427, triggering memory overflow conditions within the slpd-lite daemon.

Critical Impact

Remote attackers can exploit this buffer overflow vulnerability to potentially achieve remote code execution or cause denial of service on OpenBMC systems by sending malicious SLP packets to UDP port 427.

Affected Products

• OpenBMC systems with slpd-lite package installed (default configuration)
• slpd-lite daemon versions prior to the security patch

Discovery Timeline

• 2024-07-31 - CVE-2024-41660 published to NVD
• 2024-08-01 - Last updated in NVD database

Technical Details for CVE-2024-41660

Vulnerability Analysis

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The slpd-lite daemon processes incoming SLP packets on UDP port 427 without adequate bounds checking, allowing attackers to overflow internal memory buffers.

The vulnerability exists in the packet processing logic where user-controlled data from incoming UDP packets is copied into fixed-size buffers without proper validation of the input length. This can lead to memory corruption, potentially allowing attackers to overwrite adjacent memory regions including return addresses or function pointers.

Root Cause

The root cause is improper input validation when handling SLP packets. The slpd-lite daemon fails to verify that the size of incoming data does not exceed the allocated buffer size before copying it into memory. This classic buffer overflow pattern (CWE-120) occurs when data is copied without checking the input length against the destination buffer's capacity.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker with network access to the BMC on UDP port 427 can craft malicious SLP packets containing oversized payloads. When the vulnerable slpd-lite daemon processes these packets, the memory overflow occurs.

The attack scenario involves:

1. Identifying an OpenBMC system with slpd-lite listening on UDP port 427
2. Crafting malicious SLP packets with payload sizes exceeding expected buffer boundaries
3. Sending the packets to trigger the memory overflow condition
4. Potentially achieving code execution or system crash depending on exploit sophistication

Detection Methods for CVE-2024-41660

Indicators of Compromise

• Unexpected crashes or restarts of the slpd-lite daemon on OpenBMC systems
• Anomalous network traffic patterns targeting UDP port 427
• Memory corruption signatures or segmentation faults in BMC logs
• Unusually large or malformed SLP packets in network captures

Detection Strategies

• Monitor UDP port 427 for abnormal traffic volume or packet sizes
• Implement network intrusion detection rules for malformed SLP protocol packets
• Deploy packet inspection to identify SLP requests with oversized fields
• Review BMC system logs for slpd-lite process crashes or memory errors

Monitoring Recommendations

• Enable verbose logging on OpenBMC systems to capture slpd-lite daemon behavior
• Implement network segmentation to limit access to BMC management interfaces
• Deploy SIEM rules to correlate potential exploitation attempts across infrastructure
• Monitor for process instability patterns on BMC controllers

How to Mitigate CVE-2024-41660

Immediate Actions Required

• Apply the latest security patches from the openbmc/slpd-lite repository
• Restrict network access to UDP port 427 using firewall rules
• Isolate BMC management networks from untrusted network segments
• Consider disabling slpd-lite if SLP service discovery is not required

Patch Information

Patches are available in the latest openbmc/slpd-lite repository. Organizations should update to the patched version as soon as possible. For detailed patch information and updated releases, refer to the GitHub Security Advisory.

Workarounds

• Block or filter incoming traffic to UDP port 427 at the network perimeter
• Implement network ACLs to restrict BMC management access to trusted IP ranges only
• Disable the slpd-lite service if SLP functionality is not operationally required
• Deploy network segmentation to isolate out-of-band management interfaces

# Example: Block UDP port 427 traffic using iptables
iptables -A INPUT -p udp --dport 427 -j DROP

# Example: Restrict access to specific trusted management subnet
iptables -A INPUT -p udp --dport 427 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 427 -j DROP