Change Details

With an active session established, crafted DHCPv6 Solicit with many Rapid-Commit options exhausts fixed reply buffer causing NULL dereference. ``` Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: connect: ppp0 <--> pppoe(0c:a2:45:a5:00:00) Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: vyos2: authentication succeeded Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Main process exited, code=exited, status=255/EXCEPTION Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Failed with result 'exit-code'. Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Scheduled restart job, restart counter is at 1. Mar 29 10:58:29 vyos systemd[1]: Stopped Accel-PPP - High performance VPN server application for Linux. Mar 29 10:58:29 vyos systemd[1]: Starting Accel-PPP - High performance VPN server application for Linux... Mar 29 10:58:29 vyos systemd[1]: Started Accel-PPP - High performance VPN server application for Linux. ```

With an active session established, crafted DHCPv6 Solicit with many Rapid-Commit options exhausts fixed reply buffer causing NULL dereference. ``` Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: connect: ppp0 <--> pppoe(0c:a2:45:a5:00:00) Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: vyos2: authentication succeeded Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Main process exited, code=exited, status=255/EXCEPTION Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Failed with result 'exit-code'. Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Scheduled restart job, restart counter is at 1. Mar 29 10:58:29 vyos systemd[1]: Stopped Accel-PPP - High performance VPN server application for Linux. Mar 29 10:58:29 vyos systemd[1]: Starting Accel-PPP - High performance VPN server application for Linux... Mar 29 10:58:29 vyos systemd[1]: Started Accel-PPP - High performance VPN server application for Linux. ``` Vyos Config: ```set service pppoe-server authentication local-users username vyos password 'vyos' set service pppoe-server authentication mode 'local' set service pppoe-server client-ip-pool POOL range '10.0.0.2-10.0.0.254' set service pppoe-server client-ipv6-pool POOL6 prefix 2001:db8:1::/64 mask '64' set service pppoe-server default-ipv6-pool 'POOL6' set service pppoe-server default-pool 'POOL' set service pppoe-server gateway-address '10.0.0.1' set service pppoe-server interface eth1 set service pppoe-server ppp-options ipv6 'allow'```

With an active session established, crafted DHCPv6 Solicit with many Rapid-Commit options exhausts fixed reply buffer causing NULL dereference. ``` Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: connect: ppp0 <--> pppoe(0c:a2:45:a5:00:00) Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: vyos2: authentication succeeded Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Main process exited, code=exited, status=255/EXCEPTION Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Failed with result 'exit-code'. Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Scheduled restart job, restart counter is at 1. Mar 29 10:58:29 vyos systemd[1]: Stopped Accel-PPP - High performance VPN server application for Linux. Mar 29 10:58:29 vyos systemd[1]: Starting Accel-PPP - High performance VPN server application for Linux... Mar 29 10:58:29 vyos systemd[1]: Started Accel-PPP - High performance VPN server application for Linux. ``` Vyos Config: ```set service pppoe-server authentication local-users username vyos password 'vyos' set service pppoe-server authentication mode 'local' set service pppoe-server client-ip-pool POOL range '10.0.0.2-10.0.0.254' set service pppoe-server client-ipv6-pool POOL6 prefix 2001:db8:1::/64 mask '64' set service pppoe-server default-ipv6-pool 'POOL6' set service pppoe-server default-pool 'POOL' set service pppoe-server gateway-address '10.0.0.1' set service pppoe-server interface eth1 set service pppoe-server ppp-options ipv6 'allow'```