[Midnightbsd-cvs] [MidnightBSD/src] b7e1a3: ppp: fix three overflows in multilink endpoint dis...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: b7e1a31adeb4ef341d97704c78bc9e60178f969d
      https://github.com/MidnightBSD/src/commit/b7e1a31adeb4ef341d97704c78bc9e60178f969d
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M usr.sbin/ppp/lcp.c
    M usr.sbin/ppp/mp.c

  Log Message:
  -----------
  ppp: fix three overflows in multilink endpoint discriminator handling

mp_Enddisc() formats an endpoint discriminator into a 100 byte static
buffer.  For the magic and unrecognised classes it emits two hex digits
per byte but clamped the length as though each byte took one character,
so a discriminator longer than about half the buffer overflowed it.
Clamp to half the remaining space, and cast through unsigned char so
bytes with the high bit set are not sign extended into eight digits.
[CVE-2026-58095]

LcpDecodeConfig() did not check that a received TY_ENDDISC option is at
least the three bytes RFC 1717 requires before computing "len - 3".  A
two byte option made that -1, which reached both memcpy() and an
address[-1] store.  Reject undersized options.  [CVE-2026-58096]

mp_SetEnddisc() copied the "set enddisc psn" argument with strcpy() into
the fixed size enddisc address buffer.  Use strlcpy() and fail the
command if the argument does not fit.  [CVE-2026-58097]

ppp(8) is setuid root, so the first two are reachable by a malicious
peer and the third by any user permitted to run it.

This is FreeBSD-SA-26:60.ppp.

Obtained from:	FreeBSD
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications