A stack buffer overflow vulnerability in OpenSatKit 2.2.1 allows for potential memory corruption via malicious telecommand input.

The application utilizes the unsafe strcpy function to copy a user-provided DirName field into a fixed-size local buffer, OS_MAX_PATH_LEN. Because validation occurs after the copy operation, an attacker with local, low-privileged access can trigger a stack buffer overflow.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could allow an attacker to overwrite adjacent stack memory, leading to arbitrary code execution or system instability. This presents a significant risk to mission-critical satellite ground segment operations, potentially resulting in unauthorized control or complete loss of service.

Immediate Action: Review the provided fix commit (0c8d552dd0585a00593c08717845267d979a4951) and apply the necessary code changes to implement bounds checking prior to memory operations.

Proactive Monitoring: Monitor system logs for unexpected crashes or service interruptions related to the file manager application.

Compensating Controls: Implement strict input validation at the ground segment interface to ensure that telecommand parameters do not exceed expected length constraints.

Public Exploit Available: No (exploit_available: false)

Given the potential for total system compromise, it is imperative that developers and administrators treat this vulnerability with high priority. Users should verify their installation version and apply the upstream fix immediately to prevent exploitation of the buffer overflow condition.