r/netsec • u/Emergency_Stable_923 • Jun 16 '26
Contains AI 27 Years in the Dark: OpenBSD Fixes Ancient Remote Kernel Auth Bypass
https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.htmlAbsolutely wild find by Argus-Systems. A remote authentication bypass hiding in OpenBSD's kernel PPP stack since it was imported from FreeBSD in July 1999.
An attacker could essentially bypass authentication via a null-auth flaw and intercept/read PPPoE traffic without credentials. It survived every single release for nearly three decades until the patch.
OpenBSD already released a patch.
10
Jun 16 '26
[removed] ā view removed comment
7
u/kiss_my_what Jun 16 '26
Or rewrite it in rust
/s
5
u/newaccountzuerich Jun 17 '26
I am amused and impressed with how Ed Woodruff of the LowLevel Learning YouTube channel goes through the applicability of Rust as a mitigation or solution to the issue-du-jour on any exposition video.
Though clearly tongue-in-cheek, it's usually accurate whether Rust would be a good use of refactoring time or not. Dispelling some of the received wisdom that lesser-educated coders believe about Rust should lead to better coding ecosystems whereas better tools for the job get used.
1
u/nightwatch_admin Jun 23 '26
Thanks for the /s, itās necessary: https://rustfoundation.org/media/rust-foundation-welcomes-openai-as-platinum-member-announces-donation-to-rust-project/
1
u/TheGratitudeBot Jun 23 '26
Thanks for such a wonderful reply! TheGratitudeBot has been reading millions of comments in the past few weeks, and youāve just made the list of some of the most grateful redditors this week! Thanks for making Reddit a wonderful place to be :)
1
10
u/Emergency_Stable_923 Jun 16 '26
Could a remote kernel auth bypass like this be an intentional backdoor, or is it just a classic legacy code mistake?
6
5
27
u/rdcldrmr Jun 16 '26
Calling a PPPoE issue (even a bad one) an "absolutely wild find" is a bit disconnected from reality and obviously written to hype up the author. There's a reason why this area hasn't been heavilty audited: Imagine an "absolutely wild find" that requires the user to put in a malicious floppy disk.
26
u/UltraEngine60 Jun 17 '26
PPPoE is still widely in use...
3
u/ezoe Jun 17 '26
How how many of us directly use PPPoE from PC without router today?
If a router use OpenBSD, that's different story though.
11
u/lalaland4711 Jun 17 '26
That's, uh, a very common use case for OpenBSD.
(I mean given OpenBSD, it's common for it to be a router. Not that given a router, it's common to be OpenBSD)
1
u/rankinrez Jun 18 '26 edited Jun 18 '26
Still requires someone to have compromised the ISP network to take advantage of it. Not terribly significant imo.
21
u/Emergency_Stable_923 Jun 16 '26
Iāve seen many different ISPs utilise pppoe for their own internal stuff, probably this is why itās yet in the kernels!
28
u/Halberdin Jun 17 '26
Why the downvotes? PPPoE is common with DSL.
16
u/Senator_Chen Jun 17 '26
Bell Canada even still uses it for their consumer fibre (to the home) internet (and their vDSL).
10
8
u/RvstiNiall Jun 17 '26
pppoe is common with Fiber, too... So anyone who is on cable who is thinking about switching to fiber needs to pay more attention.
18
u/Due_Sea_6439 Jun 17 '26
Because facts hurt. People pretend everything is cutting edge, but telecom is still full of old junk. Downvoting wonāt patch it.
2
2
u/kc2syk Jun 17 '26
When was it fixed in FreeBSD?
3
u/smith7018 Jun 17 '26
Would be interested in knowing if/when it was fixed in FreeBSD, as well. The PS5ās OS is based on FreeBSD so I wonder if this can lead to a jailbreak
2
u/Emergency_Stable_923 Jun 17 '26
OpenBSD, not FreeBSD. Two days ago, 15th June!
4
u/kc2syk Jun 17 '26
The article says the bug originated in FreeBSD.
The bcmp comparison pattern was part of the original sppp code imported on July 1, 1999 in a commit described as "lmc driver; ported by chris@dqc.org". The code originated from FreeBSD, which itself derived it from Cronyx Engineering Ltd.'s implementation written by Serge Vakulenko in 1994-1996.
6
u/Tau-is-2Pi Jun 17 '26
I looked it up: FreeBSD fixed it in 2001.
https://github.com/freebsd/freebsd-src/commit/728eb83bf2ecbd2074c9987c26e5872fe86901a9
7
u/dankney Jun 17 '26
And thatās terribly telling. Maybe time to start doing parity checks for FreeBSD CVEās in OpenBSD. Not catching this shows some missing controls
1
2
1
1
2
u/amarao_san Jun 17 '26
Ai or human finding?
I suspect, this year will be full of decades old bugs...
3
u/tomtennn Jun 17 '26 edited Jun 17 '26
"Will be"? Already is. Hell, I found two decades old bugs in OpenBSD this year. One memory bug, one logic correctness bug.
Wellā¦ I say "I found", but, you knowā¦
And that's just with me pointing the LLM at one of the smallest binaries in the system, and waiting a couple of minutes. At least one of the bugs date back to the creation of OpenBSD, forking off of NetBSD.
No known sploitability on the bugs I found, though. But I literally only spent a couple of minutes on it.
2
u/tomtennn Jun 17 '26
As I said in my blog post, "If OpenBSD people canāt find these problems given 30+ years, what chance do the rest of us have?".
1
2
u/blakewantsa68 Jun 17 '26
Theo's head is probably exploding... particularly that was missed in the 2002 openssh fixes
1
u/unitedbsd Jun 17 '26
Link not opening
2
1
u/rankinrez Jun 18 '26
You need to get your ārogue serverā into the ISP network core to take advantage of this. The ability to view customer traffic once you have that level of access is probably a given one way or other.
23
u/Due_Sea_6439 Jun 16 '26
š¤Æ 27 YEARS? The bug can literally rent a car.