Heap Overflow in OpenBSD's Slaacd via Router Advertisement

by gray_chargeron 3/24/22, 3:08 PMwith 28 comments
by somaton 3/24/22, 11:21 PM

Wow! that's a hardcore patch.

expectation: signed vs unsigned overflow... probably a one line diff.

openbsd: ehhh... do we really need dnssl? lets tear the whole thing out.

https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/017_s...

Honestly, I like their attitude when it comes to deleting code.

by gjadion 3/24/22, 3:52 PM

> The OpenBSD team states that they consider that the vulnerability would be exploitable if there weren't severe privilege separation and pledge involved.

Yay!

by jms703on 3/24/22, 8:17 PM

I love the fast turnaround time from the report to the release of the patch.

by jeffbeeon 3/24/22, 6:42 PM

Function is such a mess. Even C++ would clean this right up, and then you'd actually be able to read it. I'm not even going to claim this is beautiful or flawless or whatever, but to me this kind of C++ is head and shoulders above the C code in the article in terms of readability.

https://godbolt.org/z/Mfnxq15Ma

by _wlduon 3/24/22, 4:35 PM

I wonder if the OpenBSD team would be open to Go or Rust implementations?