CVE-2024-36845

What it actually does

Invalid pointer dereference in the modbus_receive() function of libmodbus allows a crafted message to trigger a crash, resulting in denial of service.

Why it matters to the business

Disruption of Modbus-based industrial control and automation systems, leading to operational downtime and potential process interruptions in environments relying on the library.

How an attack unfolds

An attacker sends a specially crafted message to a libmodbus instance or the unit-test-server, causing the invalid pointer access in modbus_receive() that crashes the service.

How to fix it

Upgrade libmodbus to a patched release that corrects pointer validation in modbus_receive(). Apply vendor updates across all deployments and test in staging before production rollout.

How to confirm the fix worked

Confirm the deployed libmodbus version includes the fix. Replay non-malicious and boundary-case Modbus messages in a controlled environment to verify the service no longer crashes.

Typical attack path

1. Locate publicly reachable or internal libmodbus-based services
2. Craft a malicious Modbus message targeting the receive function
3. Transmit the message to trigger the invalid pointer dereference
4. Observe service crash and repeat to sustain denial of service

How to detect it

Inspect process and application logs for unexpected terminations of services using libmodbus that coincide with inbound Modbus traffic. Correlate crash timestamps with network captures on Modbus ports.

What your security team should do

• Apply available libmodbus updates immediately in all environments
• Restrict network access to Modbus services using firewalls or segmentation
• Enable logging of Modbus traffic and process crashes for monitoring