Hauke Mehrtens b2cca02d47 ead: fix out-of-bounds writes in the client message handlers ...

ead-client trusts several length and index fields taken straight from
the network when handling server responses, before authentication has
completed.  Since the client sends its requests as UDP broadcasts and
never validates the origin of the replies, any host on the same L2
segment can spoof the whole handshake and hit these paths.

handle_prime() copies sb->len bytes into saltbuf[MAXSALTLEN] (32 bytes)
without checking the length, and passes sb->prime to t_getpreparam()
without a range check.  Both come from the wire, so a salt length up to
255 overflows saltbuf and a prime index up to 255 reads (and writes)
out of bounds in the precompiled parameter table.  This is
GHSA-mq4v-mf82-24rr.

handle_b() computes the copy length as msg->len - sizeof(number) and
memcpy()s it into bbuf[MAXPARAMLEN] with no bounds check.  msg->len is
attacker controlled and only capped by the 1500 byte receive buffer, so
up to 1479 bytes land in the 256 byte bbuf.  A msg->len of 0 makes the
signed length -1, which memcpy() treats as SIZE_MAX.  This is
GHSA-8f8g-5c8x-8mhh.

handle_pong() writes the NUL terminator at pong->name[len] using an
unchecked length, allowing a one byte write past msgbuf, and the receive
loop's length check could wrap for a large msg->len.

Bound every length against its destination buffer and range check the
prime index, mirroring the checks already present on the daemon side in
ead.c (handle_send_a(), commit 63c0767f3d).  ead-client is not
installed into images by the ead package, only the daemon is, so this
only affects administrators who build and run the client by hand.

Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-mq4v-mf82-24rr
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-8f8g-5c8x-8mhh
Fixes: 2d86ea2a1d ("add the 'ead' package (emergency access daemon), which can provide remote access to your device, even if the ip and firewall settings are broken")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/25492
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

2026-10-04 17:09:00 +02:00

..

src

ead: fix out-of-bounds writes in the client message handlers

2026-10-04 17:09:00 +02:00

Makefile

ead: fix out-of-bounds writes in the client message handlers

2026-10-04 17:09:00 +02:00