CVE-2024-36844
📋 TL;DR
CVE-2024-36844 is a use-after-free vulnerability in libmodbus v3.1.6 that allows attackers to cause Denial of Service (DoS) by sending a crafted message to the unit-test-server. This affects systems using vulnerable versions of libmodbus, particularly those running the unit-test-server component.
💻 Affected Systems
- libmodbus
📦 What is this software?
Libmodbus by Libmodbus
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Modbus communication services leading to operational downtime in industrial control systems or SCADA environments.
Likely Case
Service crash of the unit-test-server component causing temporary loss of Modbus communication functionality.
If Mitigated
Limited impact with proper network segmentation and access controls preventing malicious traffic from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires sending specially crafted Modbus messages to the vulnerable unit-test-server component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.1.7 or later
Vendor Advisory: https://github.com/stephane/libmodbus/issues/749
Restart Required: Yes
Instructions:
1. Upgrade libmodbus to version 3.1.7 or later. 2. Recompile any applications using libmodbus. 3. Restart affected services using the library.
🔧 Temporary Workarounds
Disable unit-test-server
allRemove or disable the unit-test-server component if not required for operations
Stop any running unit-test-server processes
Remove unit-test-server binaries if installed
Network segmentation
allRestrict network access to systems running vulnerable libmodbus components
Configure firewall rules to limit access to Modbus ports (typically 502/TCP)
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with the unit-test-server
- Monitor for abnormal Modbus traffic patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check libmodbus version: 'modbus --version' or check package manager for libmodbus version 3.1.6Check Version:
modbus --version 2>/dev/null || dpkg -l | grep libmodbus || rpm -qa | grep libmodbusVerify Fix Applied:
Confirm libmodbus version is 3.1.7 or later and verify unit-test-server functionality after restart📡 Detection & Monitoring
Log Indicators:
- Unit-test-server crash logs
- Segmentation fault errors in system logs
- Abnormal termination of Modbus services
Network Indicators:
- Malformed Modbus packets to port 502
- Multiple connection attempts with unusual payloads
SIEM Query:
source="*modbus*" AND (error="segmentation fault" OR error="use-after-free" OR process="unit-test-server" AND event="crash")