EN PT-BR
← Voltar ao feed
medium

OpenBSD 8.0 released with PF hardening, libexpat CVE fixes and an IPsec AES-GMAC kernel heap overflow errata

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 08:01 · coletado há 6 dias

OpenBSD 8.0, the project's 61st release, was published on October 20, 2026. It hardens the PF firewall, fixes memory-safety bugs and tightens input validation in network daemons. It also updates core components, including libexpat 2.8.4, which addresses CVE-2026-66046, CVE-2026-76641 and CVE-2026-76957. Separately from the release, OpenBSD published errata for a remotely triggerable kernel heap overflow when IPsec uses AES-GMAC. It affects amd64 systems using AES-NI and Octeon systems with a cryptographic coprocessor; AES-GCM is not affected. The article does not report exploitation in the wild.

Entenda a falha

A vulnerabilidade

The most severe item is an OpenBSD kernel heap overflow that can be triggered remotely when IPsec uses AES-GMAC. It affects amd64 systems using AES-NI and Octeon systems with a cryptographic coprocessor; AES-GCM is not affected. The articles do not say whether authentication is needed or give an errata number. Separately, OpenBSD 8.0 (released October 20, 2026) fixes CVE-2026-31912 (missing program boundary checks in BPF) and updates libexpat to 2.8.4, which addresses CVE-2026-66046, CVE-2026-76641 and CVE-2026-76957. The articles give no details on those libexpat CVEs. Other errata cover a video driver use-after-free, kernel memory corruption and NSD flaws. No exploitation in the wild is reported.

Como funciona

The articles do not describe the internal flow of the IPsec bug in detail. What they say is that IPsec traffic protected with AES-GMAC reaches the kernel's cryptographic path on the affected hardware (AES-NI on amd64, or the Octeon coprocessor), and that this path writes past the end of a heap buffer. For BPF, a program whose boundaries were not properly checked could lead to out-of-bounds reads, and the new validation also blocks unhandled instructions.

Por que é vulnerável

For the IPsec flaw, the articles only say it is a kernel heap overflow specific to AES-GMAC on AES-NI and Octeon coprocessor code paths, so the fault lies in how those implementations handle data, not in AES-GCM. For BPF, the cause is missing program boundary checks, which the release adds along with validation for unhandled instructions, complementing earlier integer overflow fixes. The articles do not explain why the bugs went unnoticed.

Onde está

The articles do not name the code location of the IPsec AES-GMAC overflow or of the libexpat CVEs; they name only the BPF program boundary checks (CVE-2026-31912) and, among the PF hardening fixes, pf_rule_copyin() and DIOCIGETIFACES. The IPsec fix is published as an OpenBSD errata patch applied with syspatch.

Como foi descoberta

The articles do not say who found these flaws or how. They say OpenBSD published the IPsec AES-GMAC fix as errata separate from the 8.0 release, alongside the other errata, and that the libexpat CVEs were fixed by updating to 2.8.4. No exploitation in the wild is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 09:16.

Detalhes técnicos

  • PF: Crafted TCP reset packets can no longer incorrectly disrupt connection states. Fixes cover connection counter race underflows, an outbound-path NULL pointer dereference, an out-of-bounds read in pf_rule_copyin(), unterminated strings in ioctl interfaces and an off-by-one in DIOCIGETIFACES. Failed table attachments no longer free the caller's ruleset, and fragment reassembly now happens in the correct routing domain.
  • BPF: Program boundary checks are linked to CVE-2026-31912. Added validation blocks unhandled instructions and complements earlier integer overflow fixes.
  • httpd/relayd: httpd rejects ambiguous CL.TE framing and obsolete folded headers. relayd rejects duplicate Content-Length headers and strips Content-Length from chunked messages. Both default to the "secure" TLS cipher configuration.
  • iked, DHCP, SMTP: iked rejects malformed and out-of-state IKEv2 messages. The DHCP server no longer crashes on malicious address data and limits memory exhaustion from DHCPINFORM requests. SMTP gains better privilege separation, encrypted queue buffer validation, and rejection of unsafe usernames and CR/LF characters.
  • Other components: Perl fixes cover integer overflows in Storable, pack and unpack, plus a heap out-of-bounds read fixed in Socket 2.041. vmd loaders reject malformed ELF files, and pax blocks archives from extracting files outside the working directory.
  • Errata: Besides the IPsec AES-GMAC overflow, patches address a video driver use-after-free, kernel memory corruption and further NSD vulnerabilities.

Remediação

  • Install OpenBSD 8.0, then review the errata and apply the relevant fixes.
  • Apply binary updates with syspatch. Full binary updates exist for amd64, i386 and arm64; other architectures typically need source patches.
  • Prioritize the IPsec AES-GMAC patch on amd64 (AES-NI) and Octeon systems.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 08:01 · coletado 26/10 09:00 primeiro registro

    OpenBSD 8.0 released with PF hardening, libexpat CVE fixes and an IPsec AES-GMAC kernel heap overflow errata

    ler a análise desta fonte

    OpenBSD 8.0, the project's 61st release, was published on October 20, 2026. It hardens the PF firewall, fixes memory-safety bugs and tightens input validation in network daemons. It also updates core components, including libexpat 2.8.4, which addresses CVE-2026-66046, CVE-2026-76641 and CVE-2026-76957. Separately from the release, OpenBSD published errata for a remotely triggerable kernel heap overflow when IPsec uses AES-GMAC. It affects amd64 systems using AES-NI and Octeon systems with a cryptographic coprocessor; AES-GCM is not affected. The article does not report exploitation in the wild.

    Technical Details

    • PF: Crafted TCP reset packets can no longer incorrectly disrupt connection states. Fixes cover connection counter race underflows, an outbound-path NULL pointer dereference, an out-of-bounds read in pf_rule_copyin(), unterminated strings in ioctl interfaces and an off-by-one in DIOCIGETIFACES. Failed table attachments no longer free the caller's ruleset, and fragment reassembly now happens in the correct routing domain.
    • BPF: Program boundary checks are linked to CVE-2026-31912. Added validation blocks unhandled instructions and complements earlier integer overflow fixes.
    • httpd/relayd: httpd rejects ambiguous CL.TE framing and obsolete folded headers. relayd rejects duplicate Content-Length headers and strips Content-Length from chunked messages. Both default to the "secure" TLS cipher configuration.
    • iked, DHCP, SMTP: iked rejects malformed and out-of-state IKEv2 messages. The DHCP server no longer crashes on malicious address data and limits memory exhaustion from DHCPINFORM requests. SMTP gains better privilege separation, encrypted queue buffer validation, and rejection of unsafe usernames and CR/LF characters.
    • Other components: Perl fixes cover integer overflows in Storable, pack and unpack, plus a heap out-of-bounds read fixed in Socket 2.041. vmd loaders reject malformed ELF files, and pax blocks archives from extracting files outside the working directory.
    • Errata: Besides the IPsec AES-GMAC overflow, patches address a video driver use-after-free, kernel memory corruption and further NSD vulnerabilities.

    Remediation

    • Install OpenBSD 8.0, then review the errata and apply the relevant fixes.
    • Apply binary updates with syspatch. Full binary updates exist for amd64, i386 and arm64; other architectures typically need source patches.
    • Prioritize the IPsec AES-GMAC patch on amd64 (AES-NI) and Octeon systems.