CVE-2025-70083: OpenSatKit Buffer Overflow Vulnerability

CVE-2025-70083 Overview

A stack buffer overflow vulnerability has been identified in OpenSatKit 2.2.1, a popular open-source software kit designed for satellite ground systems. The vulnerability exists in the File Manager application's directory handling functionality, where an attacker-controlled DirName field from telecommand input can overflow a stack-based buffer via an unsafe strcpy operation.

The vulnerability is particularly concerning because the path length validation check occurs after the vulnerable copy operation has already executed, making the defensive check completely ineffective at preventing exploitation.

Critical Impact

Attackers with local access can achieve code execution by sending a maliciously crafted telecommand with an oversized DirName field, potentially compromising satellite ground segment operations.

Affected Products

• OpenSatKit 2.2.1
• OpenSatKit File Manager Application (filemgr)
• Systems utilizing OpenSatKit cFS (Core Flight System) applications

Discovery Timeline

• 2026-02-11 - CVE-2025-70083 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-70083

Vulnerability Analysis

This vulnerability represents a classic stack-based buffer overflow (CWE-121) caused by improper input validation timing. The DirName field in telecommand messages originates from the ground segment and should be treated as untrusted input. However, the vulnerable code path copies this attacker-controlled data into a fixed-size stack buffer named DirWithSep using the unsafe strcpy function without first validating the input length.

The buffer DirWithSep is sized to OS_MAX_PATH_LEN bytes. When an attacker provides a DirName value equal to or exceeding this size, the strcpy operation writes beyond the buffer boundary, corrupting adjacent stack memory including saved return addresses, saved frame pointers, and other local variables.

The local attack vector requires an attacker to have access to send telecommands to the affected system. Given the nature of satellite ground segment infrastructure, this could include operators with legitimate access or attackers who have compromised adjacent systems in the ground segment network.

Root Cause

The root cause of this vulnerability is a Time-of-Check Time-of-Use (TOCTOU) design flaw combined with unsafe string handling. The FileUtil_AppendPathSep function performs path length validation, but this check executes after the strcpy operation has already copied the malicious input into the stack buffer. This ordering error means the validation cannot prevent the overflow—it can only detect it after the damage is done.

Additionally, the use of strcpy without bounds checking is inherently unsafe when handling untrusted input. Modern secure coding practices recommend using bounded copy functions such as strncpy or strlcpy to prevent buffer overflows regardless of input validation.

Attack Vector

The attack exploits the local attack surface through the telecommand interface. An attacker constructs a telecommand message containing a DirName field with a length exceeding OS_MAX_PATH_LEN. When the File Manager application processes this command, the following sequence occurs:

1. The application receives the telecommand with the malicious DirName value
2. The program calls strcpy(DirWithSep, DirName) without first checking the length
3. The oversized DirName overflows DirWithSep, overwriting adjacent stack memory
4. Critical stack data including return addresses may be corrupted
5. The FileUtil_AppendPathSep validation executes, but the overflow has already occurred

The vulnerable code can be found in dir.c within the File Manager application. For technical details on the vulnerable code path, refer to the OpenSatKit Source Code - dir.c.

Detection Methods for CVE-2025-70083

Indicators of Compromise

• Unexpected crashes or segmentation faults in the File Manager application
• Anomalous telecommand messages containing unusually long directory path strings
• Stack smashing detection alerts from compiler-inserted canary checks (if enabled)
• Unusual process behavior following telecommand processing

Detection Strategies

• Monitor telecommand inputs for directory path strings approaching or exceeding OS_MAX_PATH_LEN
• Implement runtime stack protection mechanisms such as stack canaries and ASLR
• Deploy application-level logging to capture telecommand parameters before processing
• Use memory safety tools during development and testing to identify overflow conditions

Monitoring Recommendations

• Establish baseline metrics for File Manager application stability and memory usage
• Configure alerting for application crashes or unexpected restarts
• Log all telecommand inputs with parameter sizes for forensic analysis
• Monitor system logs for signs of memory corruption or stack smashing

How to Mitigate CVE-2025-70083

Immediate Actions Required

• Review all systems running OpenSatKit 2.2.1 and assess exposure to the telecommand interface
• Implement network-level controls to restrict access to telecommand endpoints
• Enable compiler-based protections such as stack canaries (-fstack-protector-strong) if not already enabled
• Consider deploying ASLR and DEP/NX to increase exploitation difficulty

Patch Information

No official patch has been confirmed at the time of publication. Administrators should monitor the OpenSatKit Project Repository for security updates. The vulnerable code is located in the dir.c file within the File Manager application at cfs/apps/filemgr/fsw/src/.

A proper fix should reorder operations to validate DirName length before the copy operation, and replace strcpy with a bounded copy function such as strncpy or strlcpy.

Workarounds

• Restrict telecommand interface access to trusted systems and operators only
• Implement input validation at the telecommand reception layer before passing to applications
• Consider building the application with Address Sanitizer (ASan) in non-production environments to detect exploitation attempts
• Deploy network segmentation to limit lateral movement if the ground segment is compromised

# Example: Enable stack protector when building OpenSatKit
export CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2"
make clean && make