From: Cole Munz <[email protected]>
remove_option() and update_option() clear the domain search list with
while (o->domain_search_list_len-- > 0)
domain_search_list_len is unsigned, and the post-decrement runs on the
final test too. When the length reaches 0 the condition is false but
the decrement has already wrapped it to UINT_MAX, so the field is left
corrupted. The next reset then does
o->domain_search_list[UINT_MAX] = NULL
and walks far out of bounds, writing NULL through each slot. A server
can drive this reset path against a client with PUSH_UPDATE, so on
Windows and Android this is a remotely reachable out-of-bounds write.
v2:
Change to the semantics used for all the other lists there - set
length to 0 and clear the list with CLEAR().
Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Signed-off-by: Cole Munz <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914
Github: OpenVPN/openvpn-private-issues#178
CVE: 2026-88964
---
This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914
This mail reflects revision 2 of this Change.
Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <[email protected]>
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 25a3746..f6a5fe4 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -3778,12 +3778,12 @@
memset(o->ntp, 0, sizeof(o->ntp));
o->nbdd_len = 0;
memset(o->nbdd, 0, sizeof(o->nbdd));
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
+ CLEAR(options->dns_options.from_dhcp);
+
#if defined(TARGET_ANDROID)
o->http_proxy_port = 0;
o->http_proxy = NULL;
@@ -4082,10 +4082,8 @@
CLEAR(o->ntp);
o->nbdd_len = 0;
CLEAR(o->nbdd);
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
