ASA-2019-00669 – OpenBSD: Dynamic Loader Privilege Escalation

OpenBSD  allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.

ASA-2019-00653 – OpenBSD: Local privilege escalation via S/Key and YubiKey

OpenBSD, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.

ASA-2019-00652 – OpenBSD: libc’s authentication layer performed insufficient username validation

libc in OpenBSD allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).

ASA-2019-00650 – OpenBSD: Local privilege escalation via su

A local attacker can exploit su's -L option ("Loop until a correct username and password combination is entered") to log in as themselves but with another user's login class (with the exception of root's login class if the attacker is not in the group "wheel"), because the class variable is set once and never reset.

ASA-2019-00116 – OpenBSD: IPv6 fragmentation vulnerability in OpenBSD Packet Filter

Unless IPv6 reassembly is explicitly disabled, Packet Filter reassembles IPv6 fragments to perform the filtering based on its configuration. The packets are then re-fragmented to comply with the end-to-end nature of the IPv6 fragmentation. When dealing with malicious fragmented IPv6 packets, the functions pf_reassemble6() and pf_refragment6(), may use an improper offset to apply a transformation on the packets. This behavior can have the following impacts: A kernel panic can happen, effectively stopping the system; An unexpected modification of the packets before and after the application of the filtering rules can occur. This may be leveraged to bypass the rules under some circumstances (see Rule bypass p.10). Note that with a GENERIC kernel, the panic drops to the debugger and does not reboot without a manual intervention.