3 ms·
A double-free can traditionally allow remote code execution. Maybe modern libc mitigations will protect you, maybe not.
by mkj 9y ago
A double-free can traditionally allow remote code execution. Maybe modern libc mitigations will protect you, maybe not.
- throwanem 9y agoFair point. But it looks like the scope on that one is pretty limited: > There are several issues in the extract_x509_extension() function in ssl_verify_openssl.c. This function is called if the user has used the ‘x509-username-field’ directive in their configuration. That option, per [1], appears to exist in order to support odd TLS certificates that don't use the CN field as an identifier, and is also behind a configure #define that appears not to be enabled by default. So that, if I'm reading this right, is a pretty narrow attack surface in general - not inconsiderable, to be sure, but something of a corner case. [1] https://community.openvpn.net/openvpn/attachment/ticket/124/0001-Documented-x509-username-field-option.patch https://community.openvpn.net/openvpn/attachment/ticket/124/...