mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity

openvpn: patch CVE-2026-88964

Browse Source 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-88964

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
This commit is contained in:
Ankur Tyagi committed 2026-10-13 21:32:54 +13:00
1 parent 2f0a62d30c
commit 7bd75dc53f
2 files changed
+79
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
+78
View File
@@ -0,0 +1,78 @@
From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001
From: Cole Munz <Munzzyy1@proton.me>
Date: Sun, 13 Sep 2026 15:23:17 +0200
Subject: [PATCH] options: fix unsigned underflow when clearing
domain_search_list
remove_option() and update_option() clear the domain search list with
while (o->domain_search_list_len-- > 0)
domain_search_list_len is unsigned, and the post-decrement runs on the
final test too. When the length reaches 0 the condition is false but
the decrement has already wrapped it to UINT_MAX, so the field is left
corrupted. The next reset then does
o->domain_search_list[UINT_MAX] = NULL
and walks far out of bounds, writing NULL through each slot. A server
can drive this reset path against a client with PUSH_UPDATE, so on
Windows and Android this is a remotely reachable out-of-bounds write.
v2:
Change to the semantics used for all the other lists there - set
length to 0 and clear the list with CLEAR().
Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Signed-off-by: Cole Munz <Munzzyy1@proton.me>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914
Github: OpenVPN/openvpn-private-issues#178
CVE: 2026-88964
Message-Id: <20260913132322.2283-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d)
(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2)
CVE: CVE-2026-88964
Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/openvpn/options.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index b7d035b6..847572c2 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl
memset(o->ntp, 0, sizeof(o->ntp));
o->nbdd_len = 0;
memset(o->nbdd, 0, sizeof(o->nbdd));
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
+ CLEAR(options->dns_options.from_dhcp);
+
#if defined(TARGET_ANDROID)
o->http_proxy_port = 0;
o->http_proxy = NULL;
@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl
CLEAR(o->ntp);
o->nbdd_len = 0;
CLEAR(o->nbdd);
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
+1
View File
@@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar
file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \
file://openvpn \
file://run-ptest \
file://CVE-2026-88964.patch \
"
UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"