CVE-2024-36845: 
NixOS vulnerability analysis and mitigation

CVE-2024-36845 is a vulnerability discovered in libmodbus version 3.1.6, affecting the modbus_receive() function. The vulnerability was disclosed on May 31, 2024, and involves an invalid pointer issue that can lead to a Denial of Service (DoS) condition when a crafted message is sent to the unit-test-server (NVD, Ubuntu).

The vulnerability stems from an invalid pointer manipulation in the modbus_receive() function. The issue occurs when the function incorrectly handles a query pointer or performs out-of-bounds array operations after executing malloc() to allocate memory. This results in the program crashing with an invalid pointer at free(query) (Github Issue).

When successfully exploited, the vulnerability allows attackers to cause a Denial of Service (DoS) condition in applications using libmodbus. This can result in the application crashing due to invalid pointer manipulation (NVD).

The vulnerability can be triggered by sending a specifically crafted message to the unit-test-server component. A proof of concept exists demonstrating the crash condition through invalid pointer manipulation (Github Issue).

The vulnerability affects libmodbus version 3.1.6 and requires evaluation across multiple Ubuntu releases including 24.04 LTS, 22.04 LTS, 20.04 LTS, and 18.04 LTS. Users should monitor for patches and updates from their respective distribution vendors (Ubuntu).