Summary
The SC_SendHkCmd function in sc_cmds.c dereferences multiple table address pointers (AtsInfoTblAddr, RtsInfoTblAddr, RtsCtrlBlckAddr, AtsCtrlBlckAddr, AtsCmdStatusTblAddr) without validating that any of them are non-NULL. If any of these tables have not been successfully loaded when a Housekeeping Telemetry request is processed, the application crashes with a segmentation fault.
This follows the identical vulnerability pattern as CVE-2026-15352 in the HS application, and the confirmed findings in LC (nasa/LC#136) and FM (nasa/FM#152), both of which have been accepted for remediation by the cFS engineering team.
Affected Code
File: sc/fsw/src/sc_cmds.c Function: SC_SendHkCmd (lines 37-93)
Unguarded dereferences include:
Line 50: SC_OperData.AtsInfoTblAddr[AtsIndex] — no NULL check on AtsInfoTblAddr
Line 56: SC_OperData.RtsInfoTblAddr[RtsIndex] — no NULL check on RtsInfoTblAddr
Line 65: SC_OperData.RtsCtrlBlckAddr — no NULL check
Line 70+: SC_OperData.AtsCtrlBlckAddr — no NULL check
Line 75+: SC_OperData.AtsCmdStatusTblAddr — no NULL check
None of these pointers are validated before access. If any table has not been successfully loaded, the corresponding pointer is NULL and the dereference causes a segmentation fault.
Impact
Denial of service — the SC application crashes with a segmentation fault when a routine Housekeeping Telemetry request is processed while any table pointer is in a NULL state. Loss of the Stored Commands application means the spacecraft loses the ability to execute stored command sequences, which are critical for autonomous operations.
Suggested Fix
Add NULL validation for all table address pointers before dereferencing, following the same pattern applied in the HS application for CVE-2026-15352 (commit b7530d9 by @jphickey).
Classification
CWE-476: NULL Pointer Dereference
Related: CVE-2026-15352 (HS), nasa/LC#136, nasa/FM#152 — identical pattern, all confirmed and accepted for remediation
A self-contained proof-of-concept demonstrating the crash with AddressSanitizer is available upon request.
Summary
The SC_SendHkCmd function in sc_cmds.c dereferences multiple table address pointers (AtsInfoTblAddr, RtsInfoTblAddr, RtsCtrlBlckAddr, AtsCtrlBlckAddr, AtsCmdStatusTblAddr) without validating that any of them are non-NULL. If any of these tables have not been successfully loaded when a Housekeeping Telemetry request is processed, the application crashes with a segmentation fault.
This follows the identical vulnerability pattern as CVE-2026-15352 in the HS application, and the confirmed findings in LC (nasa/LC#136) and FM (nasa/FM#152), both of which have been accepted for remediation by the cFS engineering team.
Affected Code
File: sc/fsw/src/sc_cmds.c Function: SC_SendHkCmd (lines 37-93)
Unguarded dereferences include:
Line 50: SC_OperData.AtsInfoTblAddr[AtsIndex] — no NULL check on AtsInfoTblAddr
Line 56: SC_OperData.RtsInfoTblAddr[RtsIndex] — no NULL check on RtsInfoTblAddr
Line 65: SC_OperData.RtsCtrlBlckAddr — no NULL check
Line 70+: SC_OperData.AtsCtrlBlckAddr — no NULL check
Line 75+: SC_OperData.AtsCmdStatusTblAddr — no NULL check
None of these pointers are validated before access. If any table has not been successfully loaded, the corresponding pointer is NULL and the dereference causes a segmentation fault.
Impact
Denial of service — the SC application crashes with a segmentation fault when a routine Housekeeping Telemetry request is processed while any table pointer is in a NULL state. Loss of the Stored Commands application means the spacecraft loses the ability to execute stored command sequences, which are critical for autonomous operations.
Suggested Fix
Add NULL validation for all table address pointers before dereferencing, following the same pattern applied in the HS application for CVE-2026-15352 (commit b7530d9 by @jphickey).
Classification
CWE-476: NULL Pointer Dereference
Related: CVE-2026-15352 (HS), nasa/LC#136, nasa/FM#152 — identical pattern, all confirmed and accepted for remediation
A self-contained proof-of-concept demonstrating the crash with AddressSanitizer is available upon request.