Problem Description:
ppp(8) contained three memory safety errors in its handling of
multilink endpoint discriminator options.
mp_Enddisc() used incorrect length calculations when formatting
endpoint discriminator addresses for display, allowing a received
endpoint option to overflow a global result buffer. [CVE-2026-58095]
LcpDecodeConfig() did not validate the length of received endpoint
discriminator options against the minimum required by RFC 1717.
Undersized options would trigger an out-of-bounds write. [CVE-2026-58096]
mp_SetEnddisc() copied a user-supplied PSN endpoint value without
length validation, allowing a buffer overflow via the ppp(8) command
interface. [CVE-2026-58097]
Impact:
A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096
to crash ppp(8) or potentially execute arbitrary code as root. A
local user with access to the ppp(8) command interface can exploit
CVE-2026-58097 similarly.