[Midnightbsd-cvs] [MidnightBSD/src] bf86ab: openssl: fix out-of-bounds read in DTLS retransmis...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: bf86ab813c939a8dafb0c1729c3743efe1b2037a
      https://github.com/MidnightBSD/src/commit/bf86ab813c939a8dafb0c1729c3743efe1b2037a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M crypto/openssl/ssl/d1_lib.c
    M crypto/openssl/ssl/statem/statem_dtls.c

  Log Message:
  -----------
  openssl: fix out-of-bounds read in DTLS retransmission (CVE-2026-84782)

A DTLS handshake message write can be suspended part-way through when
the transport temporarily cannot accept more data.  If the
retransmission timer fired while such a write was suspended,
dtls1_retransmit_message() reused the buffer and offset of the
suspended write without resetting init_off, so the resent message was
read from a stale offset and could run past the end of the allocated
buffer, disclosing heap memory to the peer or crashing.  The
retransmission also overwrote state the suspended write needed in
order to resume.

Backport the upstream fix to our OpenSSL 1.1.1w: always retransmit
from the start of the message, and skip retransmission entirely while
a handshake write is still suspended, deferring to the next call that
resumes it.  The 1.1.1 state machine has the same fields and the
change is identical to the 3.0 one apart from indentation.

OpenSSL 1.1.1 is out of public upstream support and 1.1.1zj is
available only to premium support customers, so this is a local
patch.

Security:       CVE-2026-84782
Security:       FreeBSD-SA-26:68.openssl
Obtained from:  FreeBSD 7b8e59ccbdfc (3.0 version)
AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: b7dbd41bf4fd64d7c4fb6e5acfd0afc04f8a5471
      https://github.com/MidnightBSD/src/commit/b7dbd41bf4fd64d7c4fb6e5acfd0afc04f8a5471
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-10-02 (Fri, 02 Oct 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: openssl DTLS retransmission fix (CVE-2026-84782)

AI-Assisted-by: Claude Fable 5.1

Co-Authored-By: Claude Fable 5.1 <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>


Compare: https://github.com/MidnightBSD/src/compare/f93d07a9b991...b7dbd41bf4fd

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications