From 7bd75dc53f49ca24e01ec11125c81481cc82175a Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Tue, 13 Oct 2026 13:03:45 +1300 Subject: [PATCH] openvpn: patch CVE-2026-88964 Backport commit identified by Debian[1], also mentioned in the release note https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 [1]https://security-tracker.debian.org/tracker/CVE-2026-88964 Signed-off-by: Ankur Tyagi --- .../openvpn/openvpn/CVE-2026-88964.patch | 78 +++++++++++++++++++ .../recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch new file mode 100644 index 0000000000..a2b9b0ec8a --- /dev/null +++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch @@ -0,0 +1,78 @@ +From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001 +From: Cole Munz +Date: Sun, 13 Sep 2026 15:23:17 +0200 +Subject: [PATCH] options: fix unsigned underflow when clearing + domain_search_list + +remove_option() and update_option() clear the domain search list with + + while (o->domain_search_list_len-- > 0) + +domain_search_list_len is unsigned, and the post-decrement runs on the +final test too. When the length reaches 0 the condition is false but +the decrement has already wrapped it to UINT_MAX, so the field is left +corrupted. The next reset then does + + o->domain_search_list[UINT_MAX] = NULL + +and walks far out of bounds, writing NULL through each slot. A server +can drive this reset path against a client with PUSH_UPDATE, so on +Windows and Android this is a remotely reachable out-of-bounds write. + +v2: + Change to the semantics used for all the other lists there - set + length to 0 and clear the list with CLEAR(). + +Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594 +Signed-off-by: Cole Munz +Acked-by: Razvan Cojocaru +Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914 +Github: OpenVPN/openvpn-private-issues#178 +CVE: 2026-88964 +Message-Id: <20260913132322.2283-1-gert@greenie.muc.de> +URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html +Signed-off-by: Gert Doering +(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d) +(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2) + +CVE: CVE-2026-88964 +Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2] +Signed-off-by: Ankur Tyagi +--- + src/openvpn/options.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/src/openvpn/options.c b/src/openvpn/options.c +index b7d035b6..847572c2 100644 +--- a/src/openvpn/options.c ++++ b/src/openvpn/options.c +@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl + memset(o->ntp, 0, sizeof(o->ntp)); + o->nbdd_len = 0; + memset(o->nbdd, 0, sizeof(o->nbdd)); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; ++ CLEAR(options->dns_options.from_dhcp); ++ + #if defined(TARGET_ANDROID) + o->http_proxy_port = 0; + o->http_proxy = NULL; +@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl + CLEAR(o->ntp); + o->nbdd_len = 0; + CLEAR(o->nbdd); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; + diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 9bf699124c..6338a0c816 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \ file://openvpn \ file://run-ptest \ + file://CVE-2026-88964.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"