CVE-2023-35847
📋 TL;DR
CVE-2023-35847 is a vulnerability in VirtualSquare picoTCP (PicoTCP-NG) where the TCP implementation lacks a minimum MSS (Maximum Segment Size) value, allowing it to be set to zero. This could enable denial-of-service attacks or potentially lead to memory corruption. Systems using picoTCP-NG version 2.1 and earlier are affected.
💻 Affected Systems
- VirtualSquare picoTCP (PicoTCP-NG)
📦 What is this software?
Picotcp by Virtualsquare
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through memory corruption leading to complete system compromise.
Likely Case
Denial-of-service causing system crashes or instability.
If Mitigated
Performance degradation or connection failures.
🎯 Exploit Status
Exploitation requires sending specially crafted TCP packets but no public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit eaf166009e44641e6570c576ba071217f100fd99
Vendor Advisory: https://github.com/virtualsquare/picotcp/commit/eaf166009e44641e6570c576ba071217f100fd99
Restart Required: Yes
Instructions:
1. Update picoTCP-NG to version after commit eaf166009e44641e6570c576ba071217f100fd99
2. Recompile any applications using the library
3. Restart affected services
🔧 Temporary Workarounds
Network filtering
linuxBlock or filter TCP packets with abnormally low MSS values
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 0:63 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy intrusion prevention systems to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check picoTCP-NG version or verify if commit eaf166009e44641e6570c576ba071217f100fd99 is appliedCheck Version:
Check build configuration or source code for picoTCP-NG versionVerify Fix Applied:
Verify picoTCP-NG version includes the MSS lower bound implementation📡 Detection & Monitoring
Log Indicators:
- System crashes
- TCP connection failures
- Memory allocation errors
Network Indicators:
- TCP packets with MSS=0 or very low MSS values
- Abnormal TCP handshake patterns
SIEM Query:
tcp.flags.syn==1 and tcp.options.mss_val<64