Executive brief
mport is the package manager for MidnightBSD operating systems, responsible for installing and managing software packages. A flaw in the bootstrap process could allow an attacker controlling a package mirror or intercepting network traffic to serve a tampered package index that mport incorrectly treats as valid, potentially leading to installation of malicious packages during system initialization.
Technical details
The vulnerability is a hash verification bypass in the mport_fetch_bootstrap_index() function in libmport/fetch.c. When bootstrap index hash verification fails (due to a missing or invalid hash), the failure path incorrectly returns success instead of propagating the fatal error to the caller. The root cause is that on hash verification failure, the function calls mport_call_msg_cb() to log the error but does not set result = MPORT_ERR_FATAL before returning, leaving result in its previous MPORT_OK state from the successful file fetch. A network attacker or compromised mirror can exploit this by serving an altered bootstrap index, which mport will proceed to use without detecting tampering. The fix, deployed in version 2.7.8, ensures the fatal error status is properly set and propagated when hash verification fails.
Affected products
- MidnightBSD mport before 2.7.8
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Version 2.7.8 includes the fix