Executive brief
A vulnerability in the OpenBSD operating system's networking code could allow a remote attacker to view sensitive information from the system's memory. By sending specially crafted network packets (MPLS frames), an attacker can trigger an error response that inadvertently includes small pieces of internal kernel data. This could potentially be used to bypass security protections or gain insights into the system's internal operations.
Technical details
An out-of-bounds read vulnerability exists in sys/netmpls/mpls_input.c within the mpls_do_error function. The function parses an incoming MPLS label stack into a fixed 16-entry local array. If a packet contains 16 labels without a Bottom-of-Stack (BoS) bit set, the loop counter reaches 16. Subsequent code uses an incorrect length calculation of (nstk + 1), resulting in a 17th entry being read from the 16-entry array. This 4-byte over-read of kernel stack memory is then included in the ICMP/MPLS error response sent back to the attacker. The vulnerability is reachable remotely if MPLS is enabled on an interface and can be exploited repeatedly to harvest kernel memory.
Affected products
- OpenBSD OpenBSD-current prior to 2026-06-18 (commit 6a23123)
Timeline
- 2026-06-12: disclosed: Reported to OpenBSD by Argus Systems
- 2026-06-18: patched: Fix committed to OpenBSD source tree
- 2026-06-18: advisory
References
- https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd
- https://pop.argus-systems.ai/advisory/adv-040.html
- https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input
- http://seclists.org/fulldisclosure/2026/Jun/17
- http://www.openwall.com/lists/oss-security/2026/06/19/3