Beat
OpenBSD
OpenBSD src, errata, and security news
OpenBSD fw_update could hand an untrusted firmware comment to a privileged helper
OpenBSD's firmware updater could treat a vendor comment as data. On the automatic install path that string could reach a privileged helper without enough checks.
find could crash listing a file with a nonsense timestamp
find can print a long directory listing. A file with a garbage timestamp made that listing crash.
A short socket-control buffer could make the kernel write past it
A program can ask the kernel to copy socket control data into a caller buffer. If that length wrapped on a too-short buffer, the kernel wrote past it into user memory.
OpenBSD 7.8 and 7.9 pick up the XML parser fixes from 2.8.3
The system XML library on the two current releases is taking the 2.8.3 changes. The drop lists fifteen CVEs and keeps the library ABI the same.
Asking a network interface for its stats leaked leftover kernel stack
A program can ask the kernel for a network interface's counters. On most machines that copy included four leftover bytes of kernel stack.
Asking for a process command line could return leftover kernel memory
A caller can ask the kernel for another process's command line. If that copy came back empty, leftover uninitialized kernel memory could still be handed back.
Some filesystem syscalls could crash if a file lost its mount
A file's kernel object can lose its mount pointer. Some filesystem syscalls did not check and could crash if they followed a null.
A missing pledge flag on a name lookup used to panic the kernel
Pledge is the kernel's per-process syscall filter. A name lookup that arrived with no pledge flag set used to panic the machine.
A crafted dynamic linker could panic OpenBSD instead of failing the exec
The kernel loads a program's dynamic linker when you run a binary. A weirdly built linker file could trip an assert and take the machine down instead of just failing the run.
Asking a terminal for its session could crash the kernel
A terminal session is the group of processes tied to a login tty. Looking up that session could follow a pointer that had already been freed, and the kernel crashed.
OpenBSD's Perl could write past a heap cache during regex matching
Perl is the interpreter OpenBSD ships. Regex matching could read and write past a heap cache that was sized too small.
OpenBSD's DHCP client read past its nameserver list when a lease sent too many
OpenBSD's DHCP client keeps a short list of nameservers from the lease. If the lease sent more than eight, verbose debug logging walked the whole buffer instead of the list and read past the end.
OpenBSD's older IKE daemon now exits if its child sends a junk bind
OpenBSD's older IKE daemon used to keep talking after its child sent a short or junk bind, so the two sides were no longer reading the same protocol. The parent now checks the payload and exits.
The kernel read past the end of a small memory map
A small memory map was asked for a field it does not have, and the kernel read one word past the end. The log does not call this a leak or a crash.
The new XML library's CVE may not apply to OpenBSD
OpenBSD -current imported a new XML parser. The CVE in that release only applies if the library is built with 16-bit characters, and the importer did not say OpenBSD ships that build.