Description

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T06:16:26.700Z",
  "pubdate": "2026-08-26T06:16:26.700Z",
  "executiveSummary": "The ppp(8) command interface contains a critical buffer overflow vulnerability located within the mp_SetEnddisc() function. The vulnerability arises due to the insufficient validation of user-supplied PSN endpoint data during input processing. By providing an overly long input string, an attacker can trigger a heap or stack-based buffer overflow, resulting in memory corruption.\nThe impact of this vulnerability is significant, as it allows for the potential execution of arbitrary code with root privileges. Successful exploitation requires local access to the ppp(8) command interface. Because ppp(8) typically operates with elevated system permissions, an attacker who successfully exploits this flaw can gain full control over the affected system. The risk is classified as critical due to the potential for complete system compromise and privilege escalation. No specific remote network exposure is inherently required, provided the local user has permission to interact with the command interface. Mitigation should focus on input sanitization and enforcing strict bounds checking within the affected source code.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the mp_SetEnddisc() function within the ppp(8) daemon. The function is responsible for managing PSN (Packet Sequence Number) endpoint values provided via the command interface. Analysis indicates that the function performs an unchecked copy operation of user-supplied data into a fixed-size internal buffer. There is a complete absence of length validation or bounds checking prior to memory allocation or buffer writes.\nThe attack flow begins when a local user initiates a command via the ppp(8) interface that invokes mp_SetEnddisc() with a specially crafted, oversized PSN endpoint string. Upon invocation, the application copies the attacker-controlled input into the destination buffer without verifying that the input size conforms to the defined buffer constraints. This behavior facilitates a classic buffer overflow condition, enabling the overwriting of adjacent memory segments.\nBy carefully crafting the malicious input, an attacker can overwrite critical control structures, such as function pointers, saved return addresses on the stack, or heap metadata. If an attacker successfully redirects the instruction pointer, they can divert execution flow to arbitrary shellcode embedded within the payload. Given the architectural context of the ppp(8) daemon, which often executes with root-level privileges to perform network interface configuration, the resulting code execution inherits these high-level permissions.\nThe exploitation process typically involves: 1) Identification of the command interface mechanism accessible to the local user. 2) Crafting a payload designed to overflow the target buffer and overwrite memory segments with a NOP sled and malicious shellcode. 3) Delivering the payload through the susceptible interface to trigger the unvalidated copy operation. 4) Achieving code execution upon the subsequent return or function call completion. The post-exploitation impact is severe, granting the attacker the ability to execute arbitrary commands, escalate privileges to root, or cause a denial-of-service state by crashing the ppp(8) daemon process. The vulnerability is local to the daemon's internal state management and does not require complex network-based interception or bypasses beyond the initial access to the command channel."
}