CVE-2024-34244

What it actually does

Buffer overflow in modbus_write_bits allows out-of-bounds read from specially crafted input, leading to crashes or undefined behavior.

Why it matters to the business

Systems relying on this library for industrial communications may experience sudden outages or erratic behavior, disrupting operations with low likelihood of data theft.

How an attack unfolds

An attacker sends a malformed request to a service using the vulnerable modbus_write_bits function, triggering the overflow during input processing.

How to fix it

Upgrade libmodbus to the latest stable release that resolves the overflow in modbus_write_bits; recompile dependent applications and validate through testing.

How to confirm the fix worked

Confirm the installed libmodbus version exceeds 3.1.10 and perform fuzz testing of modbus_write_bits with boundary inputs to ensure no crashes occur.

Typical attack path

1. Identify a network-exposed service using libmodbus
2. Craft a Modbus request with oversized or invalid bit data targeting modbus_write_bits
3. Transmit the payload over the network
4. Trigger out-of-bounds read resulting in crash or side effects

How to detect it

Review application logs and process crash dumps for segmentation faults or abnormal terminations when handling Modbus write requests; correlate with inbound traffic spikes on port 502.

What your security team should do

• Inventory all deployments using libmodbus and schedule upgrades
• Apply network segmentation to limit exposure of Modbus services
• Monitor for unusual crashes or restarts in affected processes