CVE-2025-67268: Gpsd NMEA2000 Heap Overflow DoS Vulnerability

CVE-2025-67268 Overview

CVE-2025-67268 is a heap-based out-of-bounds write vulnerability affecting gpsd, an open-source GPS service daemon widely used in navigation systems, autonomous vehicles, and IoT devices. The vulnerability exists in the drivers/driver_nmea2000.c file, specifically within the hnd_129540 function that processes NMEA2000 PGN 129540 (GNSS Satellites in View) packets. By failing to validate user-supplied satellite count values against the fixed-size skyview array (184 elements), attackers can trigger memory corruption by providing satellite counts up to 255.

Critical Impact

This vulnerability enables network-based attackers to achieve memory corruption, Denial of Service (DoS), and potentially arbitrary code execution on systems running vulnerable versions of gpsd without requiring authentication or user interaction.

Affected Products

• gpsd_project gpsd (versions prior to commit dc966aa)
• Systems utilizing gpsd for NMEA2000 protocol processing
• IoT devices and navigation systems with gpsd integration

Discovery Timeline

• 2026-01-02 - CVE CVE-2025-67268 published to NVD
• 2026-01-12 - Last updated in NVD database

Technical Details for CVE-2025-67268

Vulnerability Analysis

The vulnerability resides in the NMEA2000 protocol driver implementation within gpsd. The hnd_129540 function is responsible for handling PGN 129540 packets, which communicate GNSS satellite visibility information. When processing these packets, the function extracts a satellite count value from the incoming data but fails to perform proper bounds checking before using this value to write satellite information into the skyview array.

The skyview array is allocated with a fixed capacity of 184 elements. However, the NMEA2000 protocol allows satellite count values up to 255 (the maximum value for an 8-bit unsigned integer). When an attacker supplies a malicious packet with a satellite count exceeding 184, the function proceeds to write satellite data beyond the array's allocated memory boundaries, corrupting adjacent heap memory structures.

This heap-based out-of-bounds write condition can be exploited remotely over the network, as gpsd is designed to receive and process GPS/GNSS data from various network sources. The attack requires no authentication and no user interaction, making it highly exploitable in environments where gpsd services are network-accessible.

Root Cause

The root cause is a missing bounds validation check in the hnd_129540 function. The code trusts the satellite count value received from NMEA2000 packets without verifying it falls within the acceptable range for the destination array. This represents a classic input validation failure (CWE-122: Heap-based Buffer Overflow) where untrusted external input directly controls memory write operations without sanitization.

Attack Vector

The attack vector is network-based. An attacker can craft malicious NMEA2000 PGN 129540 packets containing an inflated satellite count (values between 185-255) and transmit them to a vulnerable gpsd instance. Upon receipt, the hnd_129540 function processes the packet and attempts to populate the skyview array with the specified number of satellite entries. When the count exceeds 184, the writes overflow the array boundary and corrupt adjacent heap memory.

Depending on heap layout and memory allocations, this corruption can lead to:

• Immediate crash (Denial of Service)
• Heap metadata corruption enabling further exploitation
• Arbitrary code execution through heap grooming techniques

The vulnerability mechanism involves the following sequence: malicious NMEA2000 packets are received by gpsd, the hnd_129540 function extracts the satellite count without validation, and write operations proceed beyond the 184-element skyview array boundary, corrupting heap memory. For detailed technical analysis, refer to the PoC documentation and the vulnerable driver source code.

Detection Methods for CVE-2025-67268

Indicators of Compromise

• Unexpected gpsd service crashes or restarts, particularly when processing NMEA2000 data
• Abnormal NMEA2000 PGN 129540 packets with satellite count values exceeding 184
• Memory corruption errors or segmentation faults in gpsd process logs
• Unusual network traffic patterns targeting gpsd listening ports

Detection Strategies

• Monitor for NMEA2000 packets with PGN 129540 containing satellite counts greater than 184
• Implement network intrusion detection rules to flag oversized satellite count fields
• Deploy memory corruption detection tools (AddressSanitizer, Valgrind) during gpsd testing
• Review gpsd logs for segmentation fault indicators or abnormal terminations

Monitoring Recommendations

• Enable verbose logging for gpsd NMEA2000 driver operations
• Configure alerting for gpsd service interruptions or unexpected restarts
• Implement network traffic analysis for NMEA2000 protocol anomalies
• Monitor system logs for heap corruption indicators related to gpsd processes

How to Mitigate CVE-2025-67268

Immediate Actions Required

• Update gpsd to a version containing commit dc966aa74c075d0a6535811d98628625cbfbe3f4 or later
• Restrict network access to gpsd services using firewall rules
• Implement network segmentation to isolate NMEA2000 data sources from untrusted networks
• Review and audit all systems utilizing gpsd for NMEA2000 protocol processing

Patch Information

The gpsd project has released a fix in commit dc966aa74c075d0a6535811d98628625cbfbe3f4. This patch adds proper bounds checking to the hnd_129540 function, ensuring satellite count values are validated against the skyview array capacity before processing. Organizations should update their gpsd installations to include this commit or upgrade to a release version that incorporates this fix. The patch details are available in the official commit.

Workarounds

• Disable NMEA2000 protocol support in gpsd configuration if not required for operations
• Deploy network-level filtering to block or inspect NMEA2000 traffic before reaching gpsd
• Run gpsd in a sandboxed environment with restricted privileges to limit exploitation impact
• Implement input validation at the network perimeter for NMEA2000 protocol data

# Example: Restrict gpsd network access using iptables
# Allow only trusted NMEA2000 data sources
iptables -A INPUT -p udp --dport 2947 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2947 -j DROP
iptables -A INPUT -p tcp --dport 2947 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2947 -j DROP