OpenBSD mpls_do_error Kernel Stack Infoleak Advisory

Vulnerability Overview The function in OpenBSD, when parsing an incoming MPLS label stack, copies entries from the fixed-size array (16 entries) into the ICMP/MPLS error response if the stack does not contain a Bottom-of-Stack (BoS) label. This results in the leakage of 4 bytes of adjacent kernel stack memory. Scope Affected Product: OpenBSD Affected Versions: OpenBSD-current prior to 2020-06-18 Fix Date: 2020-06-18 Remediation Fix Commit: On 2020-06-18, the fix was committed to Detailed Information Executive Summary The function in parses the incoming MPLS label stack. When the parsing loop completes without encountering a BoS label, reaches (16). Subsequently, the code path calculates the copy length as — 17 entries — and operates on the 16-entry object using , , and . This reads 1 (4 bytes) past the end of the array and reflects that data back to the sender, included in the generated ICMP/MPLS error message. Details The label stack parsing loop (line ~353) populates and breaks when the BoS bit is set: If no BoS label is present, the loop runs to completion, resulting in . Thereafter, the IP version branch attaches the stack as an ICMP extension object using the derived length : The same length is used to prepend and copy the stack to the reflected packet via : When , each operation reads 17 entries, accessing — which corresponds to 4 bytes of adjacent kernel stack memory for one — and includes it in the response sent to the attacker. Reachability This code path is remotely accessible via (line ~90) → on systems where MPLS is enabled on an interface. The trigger is a crafted MPLS frame carrying 16 labels with no BoS bit set and a top-level TTL of 1, designed to force the error handling path. See proof of concept. Impact Each crafted packet leaks 4 bytes of adjacent kernel stack memory. The leaked data is reflected in the ICMP/MPLS extension object, meaning any reachable attacker can collect the leaked bytes. The primitive is repeatable: sending consecutive triggers leaks different adjacent stack bytes, enabling a progressive kernel memory leak. There are no crashes or panics; the leak is silent. Timeline 2020-06-12: Reported to OpenBSD with proof of concept 2020-06-18: Fix code committed to Tags

Goal Reached Thanks to every supporter — we hit 100%!

OpenBSD mpls_do_error Kernel Stack Infoleak Advisory