From patchwork Fri Oct 23 18:56:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5500 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:848c:b0:8dc:5c83:a4ec with SMTP id z12csp7238420max; Fri, 23 Oct 2026 11:56:30 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBznofos3N92Rv27B9UwUUEIWN1CLTHYIW9UOtrBb6GlgIVPslMiCIbxO4GUG54AIyI0AKBYWY0jQw0=@openvpn.net X-Received: by 2002:a05:6830:b15:b0:845:156f:589b with SMTP id 46e09a7af769-850ff96ce92mr224693a34.30.1792781789884; Fri, 23 Oct 2026 11:56:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792781789; cv=none; d=google.com; s=arc-20260327; b=LUEE1sA9HJI00j17xm4qer8z10m5v2RJkRVMGuDfYHGGGiwVMoOLapTPjovnG0+k6C 1lq6L/9dHE5K8xp4C4sH7CKML9lHXB9KR/+HkyLaiQvddeT4JKxir5P451OgC7BDTu8T 1EoOaw1Z6zyBXQCSNvW+13D63cEKhBMtJsgFRo+lkSc9t7xR+oNtqlx1QXU30n7Ft3ZZ kiNRbuNEwqx15cKoZatFEyVQujIcfM7BYvWf5Cjm4qa4grIqqlpxxZ3hqctS7rHPrPQ6 MR8tPKCrRfVfAZZH8Xu4tCDpwRIgmZkjXkqpOw3h4LKkVy0nxBrkEoI/XDsVQtpJ7/oh zo7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=R/9ata3nbqR0Kb676h932HbvBavtKVAejTxqEnxsgYI=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=RDwVSaGK4HgILEL+Be67RkBSX+JuOamt4blCD8c8VGeOCzwVbncv593HEeFzvMjHBH pmxsG9JXYrHzmJQMfsdi3hWHiwzTzJIMcbAnWJgz+WRzVgbCCNDAnQy2YMHtg2BuHHSD a5ZgOLKVLx2dvhvuGKIxzY8htL0/mq2oFW16b3wzKmNQgTqvhYSGRXsS1NwytxHq38YC KwG6eB04VisA+Cb0rWkc79eciS6EB+SxJ9HL4atVT4hL5GrbX2SOLbsDV242BctbBNLC jVO1olvxl6letTBXL2FJRksLANBUTti4ZjwoR63dG00uVwe7kqCgKt0TsGr9vA5/L/pQ j/KQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=N9eutXYN; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="Jed7M3/4"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=WeOBf1B3; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-850fcab778csi452808a34.110.2026.10.23.11.56.29 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Oct 2026 11:56:29 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=N9eutXYN; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="Jed7M3/4"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=WeOBf1B3; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=R/9ata3nbqR0Kb676h932HbvBavtKVAejTxqEnxsgYI=; b=N9eutXYNuN9pfX JDBan692yDQfiEatInkIcqyw9PjUPUzIUu3KX5W7cV+wU52jRC73R0EuEw5QzEeXdjCoNKhY6FzzX MCIDLPw8HDtItitgJfEchPD/8icoJTq4vZa5861Rb9qqwK93BI5T5NomLfrYa0ox5CXieAnO/MAc0 PKQ=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xKKRG-000000001s8-0Maz; Fri, 23 Oct 2026 18:56:26 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xKKRE-000000001s2-0kjc for openvpn-devel@lists.sourceforge.net; Fri, 23 Oct 2026 18:56:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=QiRN3hdUN3eAma9Fghyc5LOSWgV/AdoOs+ZVW7geTdE=; b=Jed7M3/4bvo88BXENIKwEcv4nA BxsaAlzlaBb1Hwqx18ZFRto1769A4RaGqLXCeGbMwu8JZUaFf27MSz1Gb0CC7r683pNdih2X58Iiw dsxHjRbrljij8ZEzaFR2aRQ8szq/43lctUKPjM98wksKnka+VkWb3/2jEZuwys+07Qa4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=QiRN3hdUN3eAma9Fghyc5LOSWgV/AdoOs+ZVW7geTdE=; b=WeOBf1B3hB4NtNOlu1nMnA6Ne1 HFK3/Bci28pkLZgUhvm+PKzQWxTocWWmr8dCVM5HEz3NOetCld6yJu18wHuA3Cf9z+Q6xTEHzk0+v WVQHto1PLydBwQS4JyAX9607en2w/ZRgiDKYJLj/aBz5YbIObW1F31zLyd/+K50ASOs4=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xKKRC-000000006T7-2LNA for openvpn-devel@lists.sourceforge.net; Fri, 23 Oct 2026 18:56:24 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69NIuF9I005216 for ; Fri, 23 Oct 2026 20:56:15 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69NIuFRt005215 for openvpn-devel@lists.sourceforge.net; Fri, 23 Oct 2026 20:56:15 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Fri, 23 Oct 2026 20:56:09 +0200 Message-ID: <20261023185614.5201-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Naveed Khan HandleMessage() dispatches every fixed-size request only after checking that msg.header.size equals the size of the expected struct: address, route, flush_neighbors, wfp_block, enable_dhcp, set_mtu an [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xKKRC-000000006T7-2LNA Subject: [Openvpn-devel] [PATCH v1] interactive: validate message size for dns/nrpt/wins handlers X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1879867958305301543 X-GMAIL-MSGID: 1879867958305301543 From: Naveed Khan HandleMessage() dispatches every fixed-size request only after checking that msg.header.size equals the size of the expected struct: address, route, flush_neighbors, wfp_block, enable_dhcp, set_mtu and create_adapter all do this. The dns, nrpt and wins config handlers do not, so they inherit only the generic gate (header.size <= sizeof the message union). The stack message object is not zeroed, so an unprivileged pipe client can send an undersized dns/nrpt/wins message and have the service act on uninitialized stack memory: addr_len, the address array, family, the interface name and the domain lists are all read beyond the bytes that were actually received. The service runs as SYSTEM and takes these messages from any local user, so it should apply the same size check the other handlers already use. Add the matching msg.header.size == sizeof(...) check to the dns, nrpt_dns and wins cases. Acked-by: Heiko Hund Change-Id: I0083c6c5460ff2aff638598ac26f99fd30d01fd1 Signed-off-by: Naveed Khan Acked-by: Heiko Hund Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2030 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2030 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Heiko Hund diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index d36e8d5..e8203c6e 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -3292,20 +3292,27 @@ case msg_add_dns_cfg: case msg_del_dns_cfg: - ack.error_number = HandleDNSConfigMessage(&msg.dns, lists); + if (msg.header.size == sizeof(msg.dns)) + { + ack.error_number = HandleDNSConfigMessage(&msg.dns, lists); + } break; case msg_add_nrpt_cfg: case msg_del_nrpt_cfg: - { - DWORD ovpn_pid = proc_info->dwProcessId; - ack.error_number = HandleDNSConfigNrptMessage(&msg.nrpt_dns, ovpn_pid, lists); - } - break; + if (msg.header.size == sizeof(msg.nrpt_dns)) + { + DWORD ovpn_pid = proc_info->dwProcessId; + ack.error_number = HandleDNSConfigNrptMessage(&msg.nrpt_dns, ovpn_pid, lists); + } + break; case msg_add_wins_cfg: case msg_del_wins_cfg: - ack.error_number = HandleWINSConfigMessage(&msg.wins, lists); + if (msg.header.size == sizeof(msg.wins)) + { + ack.error_number = HandleWINSConfigMessage(&msg.wins, lists); + } break; case msg_enable_dhcp: