diff mbox series

[Openvpn-devel,v2] proto: correct 802.1Q length check in is_ipv_X

Message ID 20260715202210.9010-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] proto: correct 802.1Q length check in is_ipv_X |

Commit Message

Gert Doering July 15, 2026, 8:22 p.m. UTC 
  From: rootvector2 <dxbnaveed.k@gmail.com>

Github: OpenVPN/openvpn#1044

This has also been reported twice as a security relevant bug, but
only later than the original finding - and it isn't.

While --client-nat would modify a 32bit integer "after the packet"
(the place where an IPv4 address would be, in a well-formed packet),
the underlying buffer is always max-frame sized, and we never look
at the "modified integer" afterwards, so there are no consequences
warranting allocation of a CVE ID.

Signed-off-by: rootvector2 <dxbnaveed.k@gmail.com>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789
Reported-By: 章鱼哥 (www.aipyaipy.com)
Reported-By: Yu Zhang Wong <wongyuzhang45@gmail.com>
Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Arne Schwabe <arne-openvpn@rfc2549.org>
Antonio Quartulli <antonio@mandelbit.com>

Comments

Gert Doering July 17, 2026, 7:12 a.m. UTC | #1 
So, thanks for the patch.  I have added the "Signed-off-By:" line to
the commit message as our guidelines explain.

Also, this has been reported as "SECURITY ISSUE!!" by two independent
security researchers (well, their AIs, it seems) - which it isn't, as
the buffers involved are always larger than "just the packet".  Still,
it's a bug, it's a good find, and thanks for the patch.

Your patch has been applied to the master, release/2.7 and release/2.6
branch.

commit f8b15dad1258d6cf71ffa16f67efd9f8b57b9727 (master)
commit 47c9267120d3ee556c30616e1e0e218b78144441 (release/2.7)
commit 66c7d4352c10ca51c20d1fc34c978164e93d21d4 (release/2.6)
Author: rootvector2
Date:   Wed Jul 15 22:22:02 2026 +0200

     proto: correct 802.1Q length check in is_ipv_X

     Signed-off-by: rootvector2 <dxbnaveed.k@gmail.com>
     Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
     Acked-by: Antonio Quartulli <antonio@mandelbit.com>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789
     Message-Id: <20260715202210.9010-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg37652.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c
index 13fe0a5..785c021 100644
--- a/src/openvpn/proto.c
+++ b/src/openvpn/proto.c
@@ -70,7 +70,7 @@ 
         if (proto == htons(OPENVPN_ETH_P_8021Q))
         {
             const struct openvpn_8021qhdr *evh;
-            if (BLENZ(buf) < sizeof(struct openvpn_ethhdr) + sizeof(struct openvpn_iphdr))
+            if (BLENZ(buf) < sizeof(struct openvpn_8021qhdr) + sizeof(struct openvpn_iphdr))
             {
                 return false;
             }