Exploiting Buffer Overflow Vulnerabilities in Software Defined Radios

As wireless systems are becoming more complex, there is a shift towards implementing these systems completely in software and firmware rather than hardware. Software defined radios allow for quickly prototyping, testing, and deployment of flexible systems that can be upgraded in the field. However, since these systems are implemented in software, common coding mistakes in the signal processing modules can leave these systems vulnerable to traditional cyber-security attacks. As software radios become more prevalent in the industry, the risk of these vulnerabilities existing and being exploited in production systems increases significantly. In many cases, wireless security research is focused on the security of specific protocols rather than vulnerabilities in the radios themselves. Our research focuses specifically on these vulnerabilities that can exist in an implementation. We present two different examples of buffer overflow vulnerabilities in the link-layer processing blocks of a GNU Radio waveform. Both of these examples are based on poorly designed implementations and incorrect assumptions concerning the maximum possible length of a received message. By exploiting these vulnerabilities, we were able to successfully demonstrate persistent denial-of-service attacks and also the ability to remotely execute malicious code on the target. While a better implementation would solve these specific issues, these are examples of common programming mistakes that leave the system vulnerable to attack and can be easily overlooked during development.