Summary
The CS (Checksum) application dereferences multiple table pointers (ResTablesTblPtr, DefTablesTblPtr, ResAppTblPtr, DefAppTblPtr, ResEepromTblPtr, ResMemoryTblPtr) across cs_cmds.c without validating that they are non-NULL. There are 49 instances of unguarded table pointer dereferences in this file. If any of these tables have not been successfully loaded, the application crashes with a segmentation fault.
This follows the identical vulnerability pattern as CVE-2026-15352 in the HS application, and the confirmed findings in LC (nasa/LC#136) and FM (nasa/FM#152), both of which have been accepted for remediation by the cFS engineering team.
Affected Code
File: cs/fsw/src/cs_cmds.c Instances: 49 unguarded table pointer dereferences
Example — CS_BackgroundCheckCmd (line 261):
c
ResultsEntry = CS_OperData.ResTablesTblPtr[CS_AppData.CurrEntry];
ResTablesTblPtr is dereferenced without checking for NULL. This pattern repeats across multiple functions in the file for all six table pointers listed above.
Impact
Denial of service — the CS application crashes with a segmentation fault when any command or background check function accesses an unloaded table pointer. Loss of the Checksum application means the spacecraft loses data integrity verification capabilities, potentially allowing corrupted data or code to go undetected.
With 49 unguarded dereferences, the attack surface is broad — multiple command handlers and the background check routine are all vulnerable.
Suggested Fix
Add NULL validation for all table pointers before dereferencing, following the same pattern applied in the HS application for CVE-2026-15352 (commit b7530d9 by @jphickey). Given the 49 instances, a systematic approach using accessor functions (similar to the HS fix) would ensure consistent protection.
Classification
CWE-476: NULL Pointer Dereference
Related: CVE-2026-15352 (HS), nasa/LC#136, nasa/FM#152 — identical pattern, all confirmed and accepted for remediation
A self-contained proof-of-concept demonstrating the crash with AddressSanitizer is available upon request.
Summary
The CS (Checksum) application dereferences multiple table pointers (ResTablesTblPtr, DefTablesTblPtr, ResAppTblPtr, DefAppTblPtr, ResEepromTblPtr, ResMemoryTblPtr) across cs_cmds.c without validating that they are non-NULL. There are 49 instances of unguarded table pointer dereferences in this file. If any of these tables have not been successfully loaded, the application crashes with a segmentation fault.
This follows the identical vulnerability pattern as CVE-2026-15352 in the HS application, and the confirmed findings in LC (nasa/LC#136) and FM (nasa/FM#152), both of which have been accepted for remediation by the cFS engineering team.
Affected Code
File: cs/fsw/src/cs_cmds.c Instances: 49 unguarded table pointer dereferences
Example — CS_BackgroundCheckCmd (line 261):
c
ResultsEntry = CS_OperData.ResTablesTblPtr[CS_AppData.CurrEntry];
ResTablesTblPtr is dereferenced without checking for NULL. This pattern repeats across multiple functions in the file for all six table pointers listed above.
Impact
Denial of service — the CS application crashes with a segmentation fault when any command or background check function accesses an unloaded table pointer. Loss of the Checksum application means the spacecraft loses data integrity verification capabilities, potentially allowing corrupted data or code to go undetected.
With 49 unguarded dereferences, the attack surface is broad — multiple command handlers and the background check routine are all vulnerable.
Suggested Fix
Add NULL validation for all table pointers before dereferencing, following the same pattern applied in the HS application for CVE-2026-15352 (commit b7530d9 by @jphickey). Given the 49 instances, a systematic approach using accessor functions (similar to the HS fix) would ensure consistent protection.
Classification
CWE-476: NULL Pointer Dereference
Related: CVE-2026-15352 (HS), nasa/LC#136, nasa/FM#152 — identical pattern, all confirmed and accepted for remediation
A self-contained proof-of-concept demonstrating the crash with AddressSanitizer is available upon request.