A memory safety vulnerability in the OpenXC isotp-c library allows unauthenticated remote attackers to trigger out-of-bounds reads, potentially leading to denial of service or information disclosure.

This vulnerability occurs in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used as a size argument for memory operations without validation against actual CAN frame boundaries. An unauthenticated attacker can supply a malicious CAN frame with an oversized length nibble to trigger memory access outside the intended buffer.

The exploitation of this vulnerability could lead to system instability or the unauthorized disclosure of sensitive memory contents. Given the CVSS score of 7.1, this represents a high-risk scenario, particularly for automotive or industrial control systems where the isotp-c library is integrated to handle Controller Area Network (CAN) communications. Failure to address this could result in service disruption or the exposure of critical operational data.

Immediate Action: Review the OpenXC isotp-c repository for updates or patches that implement strict validation of the CAN data length nibble against the actual received buffer size.

Proactive Monitoring: Monitor CAN bus traffic for malformed frames or unexpected packet sizes that deviate from standard ISO-TP protocol specifications.

Compensating Controls: Implement strict input validation at the hardware or gateway level to drop CAN frames that present invalid or oversized length parameters before they reach the processing layer.

Public Exploit Available: Unknown

Organizations utilizing the openxc/isotp-c library in production environments must prioritize assessing their integration for this memory safety flaw. Because the vulnerability exists within the critical receive handler, it is imperative to apply official vendor patches or implement rigorous input filtering as soon as a fix is verified to prevent potential service disruption or unauthorized data access.