WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf
The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.
- find_type_by_name() reads unbounded strings into a fixed stack buffer via fscanf
- Triggered by crafted or oversized filesystem-backed attribute values
- Disclosure title references WireGuard but the flaw is in the Linux IIO lsiio utility
- Vendors
- Linux
- Products
- Linux IIO lsiio
From the original article
Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. The vulnerability occurs in the find_type_by_name() function, where the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...)
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.