From patchwork Wed Oct 21 16:57:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5496 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:848c:b0:8dc:5c83:a4ec with SMTP id z12csp4305146max; Wed, 21 Oct 2026 09:58:20 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxyL0bIdVOEt3qet85EACnhEAurBgkTkHXtZ/Ns6KY+FOE69BzqNT1y92tHqpDTXmp6V1N3MwmFGyk=@openvpn.net X-Received: by 2002:a05:6820:178c:b0:6d8:ac5f:88af with SMTP id 006d021491bc7-70941609623mr1694313eaf.33.1792601900661; Wed, 21 Oct 2026 09:58:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792601900; cv=none; d=google.com; s=arc-20260327; b=mAybZW4AVN8Y9Ko04kzs3uzhktoItluQhP35dxbq/7YM4ESIFlchyHMwtCk6FraKyk Q43HdPg8RQ/Lgbrk8ZZqdSpriI3v/w9skhexIOpwAXPN63m8uzpTz0LgMpqvKH1pOz/L bXBJhIyqQ1uwRsBfhhyZ2Ozxx5z7uOTWUlS3XqO7e++TunUe+6Zjcf78lvG6uBUTMpBa 4+Yz6WrpsAVvf1+m9sY2JqieoQGTsIdpyQ6aQ+63Iz63ytDkdO2/E5dEIViBecRJ5nq1 CrQmgI5FZEbBlkr9+lQn76IYSh6fbOI3dYm3GQrnHTOa9dp88xWy2WDuRvTofSBNRTlb QsNQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=TmufyYJjeF3foOfZaZF77DzAMA0eK77OCO8Uj/gW98c=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=GeXmog49wNG2D2CVx/gZg5ewJCu2IwkeF5G61fGix9a0hhmbD3gH/jByeHUg26MUOO gnqIlLwQOm9QYt6+ZozHn0IACXZaHrL/ZpaReybIUXURY/EBE5rxIXAwfM49+X67IpVX 12cG04hI1QLASVPuEWm4RKLfwtDLim5MCGodqbgHzLaYluxDrgffe3ijfYNui7uV17NS 054ICCmnBOjrDSgv7HG0arZu7H2WcA2ZgpHDKqpOlBef6ZJV9/RruQeXbJoZQu4VhFgd lxwLLSCTv3kLkO03Grqt5bgIk4wNkLPoWvehIsVNxXfW39Qx9aSPJvzgf667DtmWD5PM kHXQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Nx3TE5sy; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=QXA8q6Gn; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YBkpMgLx; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a7d5eae1basi4243473fac.22.2026.10.21.09.58.20 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Oct 2026 09:58:20 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Nx3TE5sy; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=QXA8q6Gn; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YBkpMgLx; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=TmufyYJjeF3foOfZaZF77DzAMA0eK77OCO8Uj/gW98c=; b=Nx3TE5sy5E8Ggi7OniL3BsAfuQ l1/6eeySWXbTY/M/NVlzhCAI9tYNIfR6QO5jnp0wsfL77klHi4HB5wD8PWJyjTxQmEZP+kgzFTeK2 tFYApDDAhzKEt0qLOGfmeFSR5I0lKCgJeVWbgihUr4cBYuw9RVSdIMFUY/qam8XR0ZFQ=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1xJZdi-0007h7-Eo; Wed, 21 Oct 2026 16:58:10 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1xJZdN-0007gd-OR for openvpn-devel@lists.sourceforge.net; Wed, 21 Oct 2026 16:57:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=egGkI3bGCd6eN2cgad26NjS6wPVCXPudupaWsYbaCSg=; b=QXA8q6GnaQqWxRZXJ2W9vBx7Pb meMmsy95pGTqgcFFnp+uGZPVysbyeWFuBFTdIfkOt+hRySA2j+D2E0pn56EarE5ddBbOKyE0V4YZg sSiaY/sH35+Kti3KJWJLmDjSLZ/XUmJuZi5Pgnsk7fPrE+EyaqTPLAiYy7OjFeCvqEs4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=egGkI3bGCd6eN2cgad26NjS6wPVCXPudupaWsYbaCSg=; b=YBkpMgLxwAwRl7FRSPS62KSuKw m/99jCEFGWunsEFZ+GsQBpb+VC8EI3EVCY/hbvtIlMvFTkpD6MExkk6kFzVfx6Ta5ZoOOaKfSpI5m sPURaxav0YOp74It9OkPlrQZ1xL6NhgnD/I5AcvW5IfDOpV2TTBbPGAVg+vfiQcvY0MA=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xJZdG-0000000010t-3HYb for openvpn-devel@lists.sourceforge.net; Wed, 21 Oct 2026 16:57:43 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69LGvZoh011188 for ; Wed, 21 Oct 2026 18:57:35 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69LGvZwb011185 for openvpn-devel@lists.sourceforge.net; Wed, 21 Oct 2026 18:57:35 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Oct 2026 18:57:29 +0200 Message-ID: <20261021165735.11175-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Naveed Khan HandleAddressMessage() and HandleRouteMessage() pass the client supplied interface name to InterfaceLuid() and strlen() without making sure it is null-terminated. A pipe client sending a message with [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xJZdG-0000000010t-3HYb Subject: [Openvpn-devel] [PATCH v1] interactive: null-terminate iface.name in address and route handlers X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1879679330676975504 X-GMAIL-MSGID: 1879679330676975504 From: Naveed Khan HandleAddressMessage() and HandleRouteMessage() pass the client supplied interface name to InterfaceLuid() and strlen() without making sure it is null-terminated. A pipe client sending a message with iface.index set to TUN_ADAPTER_INDEX_INVALID and a 256 byte name without a terminating NUL makes the service read past the name into the remainder of the on-stack pipe_message_t and beyond. This is hardening rather than a fix for an exploitable bug: the trailing bytes only ever reach ConvertInterfaceAliasToLuid(), which fails on them, and nothing is returned to the client beyond an error code. Terminate the name anyway, like HandleDNSConfigMessage() and HandleDNSConfigNrptMessage() already do. Github: OpenVPN/openvpn#1130 Change-Id: I26fe14053446dbd215f947910565c20318c34627 Signed-off-by: Naveed Khan Signed-off-by: Lev Stipakov Acked-by: Heiko Hund Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2027 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2027 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Heiko Hund diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index ed163a4..d36e8d5 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -575,6 +575,9 @@ PMIB_UNICASTIPADDRESS_ROW addr_row; BOOL add = msg->header.type == msg_add_address; + /* enforce null-termination of the interface name from client */ + msg->iface.name[_countof(msg->iface.name) - 1] = '\0'; + addr_row = malloc(sizeof(*addr_row)); if (addr_row == NULL) { @@ -653,6 +656,9 @@ PMIB_IPFORWARD_ROW2 fwd_row; BOOL add = msg->header.type == msg_add_route; + /* enforce null-termination of the interface name from client */ + msg->iface.name[_countof(msg->iface.name) - 1] = '\0'; + fwd_row = malloc(sizeof(*fwd_row)); if (fwd_row == NULL) {