[Midnightbsd-cvs] [MidnightBSD/src] 14cc9d: openssl: fix out-of-bounds read in DTLS retransmis...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 14cc9d03c6d586d76ac5dcdd4657edbaaf171a3a
      https://github.com/MidnightBSD/src/commit/14cc9d03c6d586d76ac5dcdd4657edbaaf171a3a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M crypto/openssl/ssl/d1_lib.c
    M crypto/openssl/ssl/statem/statem_dtls.c

  Log Message:
  -----------
  openssl: fix out-of-bounds read in DTLS retransmission (CVE-2026-84782)

A DTLS handshake message write can be suspended part-way through when
the transport temporarily cannot accept more data.  If the
retransmission timer fired while such a write was suspended,
dtls1_retransmit_message() reused the buffer and offset of the
suspended write without resetting init_off, so the resent message was
read from a stale offset and could run past the end of the allocated
buffer, disclosing heap memory to the peer or crashing.  The
retransmission also overwrote state the suspended write needed in
order to resume.

Backport the upstream fix: always retransmit from the start of the
message, and skip retransmission entirely while a handshake write is
still suspended, deferring to the next call that resumes it.

OpenSSL 3.0 reached end of public upstream support in September 2026
and 3.0.23 is available only to premium support customers, so this is
a local patch rather than a vendor update.  The upstream regression
test targets the 3.5 test suite and is not included.

Security:       CVE-2026-84782
Security:       FreeBSD-SA-26:68.openssl
Obtained from:  FreeBSD 7b8e59ccbdfc
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: 94b69bb22ce838f9d51e33640867fcf57ae9a0e0
      https://github.com/MidnightBSD/src/commit/94b69bb22ce838f9d51e33640867fcf57ae9a0e0
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: openssl DTLS retransmission fix (CVE-2026-84782)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


Compare: https://github.com/MidnightBSD/src/compare/877558fd8d94...94b69bb22ce8

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications