CVE-2025-67268
📋 TL;DR
This vulnerability in gpsd allows attackers to trigger heap-based out-of-bounds writes by sending specially crafted NMEA2000 PGN 129540 packets with excessive satellite counts. This can lead to memory corruption, denial of service, and potentially remote code execution. Systems running vulnerable versions of gpsd that process NMEA2000 data are affected.
💻 Affected Systems
- gpsd
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise
Likely Case
Denial of service causing gpsd service crashes and GPS functionality disruption
If Mitigated
Service disruption without privilege escalation if memory protections are in place
🎯 Exploit Status
Exploitation requires sending malformed NMEA2000 packets to gpsd's listening port
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit dc966aa74c075d0a6535811d98628625cbfbe3f4 and later
Vendor Advisory: https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4
Restart Required: Yes
Instructions:
1. Update gpsd to latest version from official repository
2. Apply commit dc966aa74c075d0a6535811d98628625cbfbe3f4
3. Restart gpsd service
🔧 Temporary Workarounds
Disable NMEA2000 processing
linuxConfigure gpsd to not process NMEA2000 data streams
Edit gpsd configuration to exclude NMEA2000 sources
Network isolation
linuxRestrict network access to gpsd service
iptables -A INPUT -p tcp --dport 2947 -j DROP
ufw deny 2947/tcp
🧯 If You Can't Patch
- Implement strict network segmentation to isolate gpsd from untrusted networks
- Use application firewalls to filter NMEA2000 traffic to gpsd
🔍 How to Verify
Check if Vulnerable:
Check gpsd version and verify if commit dc966aa is present: git log --oneline | grep dc966aaCheck Version:
gpsd --versionVerify Fix Applied:
Verify the fix by checking the driver_nmea2000.c file for proper satellite count validation📡 Detection & Monitoring
Log Indicators:
- gpsd segmentation faults
- gpsd service crashes
- unusual memory allocation patterns
Network Indicators:
- NMEA2000 PGN 129540 packets with satellite count > 184
SIEM Query:
process:gpsd AND (event_type:crash OR memory_violation)