OpenBSD fw_update could hand an untrusted firmware comment to a privileged helper
Brief
OpenBSD’s firmware updater installs packages from vendor files. An untrusted comment on those files could be treated as data and, on the automatic path, handed to a privileged fetch helper without enough checks. The fix trusts signify’s output and tightens validation before that privilege step.
Notes
msg163004 (djl@ / David Leadbeater, 2026-08-27 21:56:19). usr.sbin/fw_update/fw_update.sh. Log: “fw_update could be tricked into treating the untrusted comment as data. In some situations (-a) this could be passed into fetch(), which did not validate what it passed to su(1). Use the trusted output of signify and add stricter validation.” with & ok afresh1@.
No OpenBSD src SHA on GitHub or Codeberg yet (mirror still lagging). Do not invent one.
Committed to -current; no errata patch yet. errata79 / errata78 last SECURITY FIX still 2026-08-22; no fw_update errata in this pass.
Commit msg163004