Description

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T06:16:26.577Z",
  "pubdate": "2026-08-26T06:16:26.577Z",
  "executiveSummary": "The ppp(8) utility contains two vulnerabilities, tracked as CVE-2026-58095 and CVE-2026-58096, stemming from improper validation of length fields within PPP (Point-to-Point Protocol) endpoint discriminator options.\nThe vulnerability type is an out-of-bounds write resulting from a lack of boundary checking in the LcpDecodeConfig() function.\nA remote, unauthenticated malicious peer can exploit these flaws to trigger memory corruption, leading to a service crash or the execution of arbitrary code with root privileges.\nGiven that ppp(8) often operates with high-level system permissions, these vulnerabilities present a critical risk to the confidentiality, integrity, and availability of the affected host.\nExploitation is possible over the network via standard PPP negotiation packets, requiring no prior authentication or physical access to the target system.",
  "technicalDetails": "The root cause of these vulnerabilities is located within the LcpDecodeConfig() function, which is responsible for parsing Link Control Protocol (LCP) configuration options during the establishment phase of a PPP session.\nSpecifically, the function fails to enforce the minimum length requirements for endpoint discriminator options as mandated by RFC 1717. When an attacker sends a crafted PPP packet containing an undersized endpoint discriminator option, the LcpDecodeConfig() function performs an out-of-bounds write operation during the memory copy or decoding process.\nThe attack flow commences with the attacker acting as a malicious PPP peer. By initiating or participating in an LCP negotiation, the attacker transmits a specially crafted configuration request packet. The LcpDecodeConfig() function processes this packet and, failing to validate the length of the provided option against the protocol specification, proceeds to copy the malformed data into a buffer.\nBecause the length validation logic is deficient, the memory copy operation exceeds the allocated buffer boundaries. This memory corruption allows an attacker to overwrite adjacent memory structures, which may include function pointers or sensitive stack variables depending on the memory layout of the process at runtime.\nSuccessful exploitation of this out-of-bounds write can be weaponized to redirect the execution flow of the ppp(8) process. By overwriting return addresses or control data, an attacker can gain control of the instruction pointer, leading to arbitrary code execution. Because ppp(8) typically requires root privileges to manage network interfaces and routing tables, code execution achieved through this vulnerability results in full system compromise.\nThe vulnerability affects the ppp(8) utility's handling of LCP packets. Since PPP is a foundational protocol for network connectivity, the attack vector is exposed to any network interface where ppp(8) is actively negotiating peer connections. No authentication is required to reach the vulnerable code path, as the packet processing occurs during the initial handshake phase of the session establishment."
}