[Midnightbsd-cvs] [MidnightBSD/src] 0f8a90: ppp: fix three overflows in multilink endpoint dis...

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 0f8a90d2efe6858a6113963629733a3cb0fc91f4
      https://github.com/MidnightBSD/src/commit/0f8a90d2efe6858a6113963629733a3cb0fc91f4
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M usr.sbin/ppp/lcp.c
    M usr.sbin/ppp/mp.c

  Log Message:
  -----------
  ppp: fix three overflows in multilink endpoint discriminator handling

mp_Enddisc() formats an endpoint discriminator into a 100 byte static
buffer.  For the magic and unrecognised classes it emits two hex digits
per byte but clamped the length as though each byte took one character,
so a discriminator longer than about half the buffer overflowed it.
Clamp to half the remaining space, and cast through unsigned char so
bytes with the high bit set are not sign extended into eight digits.
[CVE-2026-58095]

LcpDecodeConfig() did not check that a received TY_ENDDISC option is at
least the three bytes RFC 1717 requires before computing "len - 3".  A
two byte option made that -1, which reached both memcpy() and an
address[-1] store.  Reject undersized options.  [CVE-2026-58096]

mp_SetEnddisc() copied the "set enddisc psn" argument with strcpy() into
the fixed size enddisc address buffer.  Use strlcpy() and fail the
command if the argument does not fit.  [CVE-2026-58097]

ppp(8) is setuid root, so the first two are reachable by a malicious
peer and the third by any user permitted to run it.

This is FreeBSD-SA-26:60.ppp.

Obtained from:	FreeBSD
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5
(cherry picked from commit b7e1a31adeb4ef341d97704c78bc9e60178f969d)



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications