Description

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:19.867Z",
  "pubdate": "2026-11-05T19:17:19.867Z",
  "executiveSummary": "accel-ppp versions prior to 1.15.0 are susceptible to a heap-based buffer overflow vulnerability residing within its logging subsystems.\nThe vulnerability affects the tcp, syslog, and pgsql log targets, which fail to properly validate the length of log lines before writing them to fixed-size heap buffers.\nUnauthenticated remote attackers positioned within the authorized client-ip-range can trigger this flaw by initiating an L2TP Start-Control-Connection-Request containing an excessive number of string Attribute-Value Pairs (AVPs).\nWhen verbose logging is enabled, the daemon processes these oversized inputs, causing them to exceed the defined LOG_MAX_SIZE limit.\nSuccessful exploitation results in heap memory corruption, which typically leads to an immediate crash of the accel-ppp daemon, facilitating a remote denial-of-service (DoS) condition.\nThis vulnerability is critical for service availability, as it allows unauthorized network entities to disrupt the daemon's operations without requiring valid authentication credentials.",
  "technicalDetails": "The root cause of this vulnerability is an improper bounds check within the logging mechanism of accel-ppp. Specifically, the implementation assumes that incoming log data intended for the tcp, syslog, or pgsql logging targets will not exceed the static buffer size, defined by the constant LOG_MAX_SIZE.\nThe vulnerability is exposed when the application is configured to perform verbose logging. Under these conditions, the daemon attempts to serialize diagnostic data into a heap-allocated buffer. When an attacker sends an L2TP Start-Control-Connection-Request featuring an inflated number of string AVPs, the resulting log output surpasses the allocation boundary of the heap buffer.\nThe attack flow proceeds as follows: First, the attacker identifies a target system running an affected version of accel-ppp with verbose logging enabled. Second, the attacker establishes network connectivity within the permitted client-ip-range. Third, the attacker crafts a malicious L2TP packet, specifically populating the AVP fields with arbitrary strings designed to maximize the size of the generated log line. Fourth, as the daemon processes the malformed packet, the log function triggers a write operation that exceeds the allocated memory segment on the heap.\nBecause the buffer is allocated on the heap, the overflow overwrites adjacent heap metadata or adjacent application data structures. This corruption leads to unpredictable program behavior, ultimately causing the process to terminate due to a segmentation fault or memory protection violation. The use of fixed-size buffers without sufficient length verification or safe memory management primitives allows the injected data to bypass intended memory boundaries.\nThe exposure is strictly network-based; however, the reliance on the client-ip-range configuration acts as a prerequisite for the attacker to reach the vulnerable code path. Since the overflow occurs during the processing of initial control messages, no user authentication is required to reach the vulnerable logging code. The impact is primarily restricted to availability, as the daemon service is terminated; however, in certain memory layouts, heap corruption can theoretically be leveraged to overwrite function pointers or other critical memory structures, though the primary observed outcome is a service crash."
}