Executive brief
ION-DTN is NASA's open-source implementation of Delay Tolerant Networking used for communication in challenging environments like deep space and remote locations. Versions before 4.2.0 contain an out-of-bounds memory read vulnerability that allows an unauthenticated attacker to read sensitive memory by sending specially crafted network packets to the LTP link service port, potentially exposing confidential data or configuration information.
Technical details
The vulnerability is an out-of-bounds read in the decodeSdnv function, which parses SDNV (Self-Delimiting Numeric Value) structures used by ION-DTN's Link Transmission Protocol (LTP). An attacker can send a UDP datagram with a truncated SDNV value to trigger reads up to nine bytes past the allocated buffer boundary and cause byte counter underflows. The vulnerability is network-accessible without authentication; a remote attacker can exploit this by targeting the LTP link service input port. While the primary impact is information disclosure through memory read, the out-of-bounds access could potentially lead to crash conditions. Patches are available in version 4.2.0 and later.
Affected products
- NASA ION-DTN before 4.2.0
Timeline
- 2026-09-02: disclosed