CVE-2023-43628: 
NixOS vulnerability analysis and mitigation

An integer underflow vulnerability (CVE-2023-43628) was discovered in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. The vulnerability was discovered by Dimitrios Tatsis of Cisco Talos and publicly disclosed on December 5, 2023. GPSd is a daemon used for monitoring, collecting, and reporting GPS information to clients, and is extensively used in Android devices, drones, robot submarines, driverless cars, marine navigation, and military systems (Talos Report).

The vulnerability exists in the NTRIP Stream Parsing functionality where a specially crafted network packet can lead to memory corruption. The issue occurs in the lexer_getline() function where the lexer->inbuflen variable can be decremented below zero, causing an integer underflow. When this happens, the variable becomes 0xffffffffffffffff, leading the code to attempt a memmove() operation with an invalid size parameter, potentially resulting in memory corruption. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST and 5.9 (MEDIUM) by Talos, with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (Talos Report, NVD).

The vulnerability can be triggered by sending a malicious packet to the affected system, potentially causing the GPSd service to crash. Given GPSd's widespread use in critical systems such as drones, autonomous vehicles, and military applications, a successful exploitation could lead to service disruption in these systems (Talos Report).

A patch for this vulnerability was released on November 29, 2023, following the initial vendor contact on November 22, 2023, and vendor disclosure on November 23, 2023 (Talos Report).