Description

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T06:16:26.460Z",
  "pubdate": "2026-08-26T06:16:26.460Z",
  "executiveSummary": "A critical memory safety vulnerability exists in the ppp(8) utility due to improper bounds checking within the mp_Enddisc() function. This vulnerability is classified as a buffer overflow, specifically occurring during the formatting of endpoint discriminator addresses received from a PPP peer.\nThe flaw allows a remote, unauthenticated attacker to supply a maliciously crafted endpoint option, resulting in a heap-based or global buffer overflow. Successful exploitation can lead to a denial-of-service (DoS) condition via application crash or, under specific memory conditions, the execution of arbitrary code with root privileges.\nGiven that ppp(8) typically operates with elevated system permissions to manage network interfaces, this vulnerability poses a severe risk to system integrity and confidentiality. Exposure is primarily limited to systems actively accepting PPP connections from untrusted peers. No user interaction or prior authentication is required to trigger the overflow, making it an attractive target for remote exploitation in network-facing deployments.",
  "technicalDetails": "The vulnerability resides within the mp_Enddisc() function, which is responsible for parsing and formatting endpoint discriminator addresses received during the Link Control Protocol (LCP) negotiation phase of the Point-to-Point Protocol (PPP). The flaw stems from an incorrect length calculation when copying the received endpoint option data into a fixed-size global result buffer.\nWhen a PPP peer sends a malformed endpoint discriminator option, the mp_Enddisc() function fails to validate the size of the incoming data against the destination buffer's capacity. By supplying an option length that exceeds the buffer's allocated size, an attacker can perform an out-of-bounds write operation.\nThe attack flow proceeds as follows: 1) The attacker initiates a PPP connection with the target system. 2) During the LCP negotiation, the attacker transmits a crafted endpoint discriminator option. 3) The target's ppp(8) process receives this option and passes it to the mp_Enddisc() function. 4) The function incorrectly calculates the required storage space and performs a copy operation that exceeds the bounds of the global result buffer. 5) This overwrite corrupts adjacent memory structures, such as function pointers, return addresses, or metadata related to heap management.\nThe impact of this memory corruption is twofold. If the overwritten data causes an illegal memory access or violates structural integrity, the ppp(8) process will encounter a segmentation fault, resulting in a system-wide denial-of-service for the network interface managed by that daemon. Alternatively, if an attacker carefully crafts the payload, they can control the execution flow of the application. Since ppp(8) is designed to run with root privileges to manipulate network configurations, achieving arbitrary code execution results in a full compromise of the affected host.\nThe vulnerability is exposed to any network interface listening for PPP traffic. Because the parsing logic executes before any authentication mechanisms are finalized, the attack is effective against unauthenticated peers. There are no specific version constraints provided, but all implementations of ppp(8) utilizing the flawed mp_Enddisc() logic for discriminator processing are considered susceptible."
}