Branch: refs/heads/main Home: https://github.com/kronosnet/kronosnet Commit: 0f66366cbe3fc6d7742571187442ba5cda627d1d https://github.com/kronosnet/kronosnet/commit/0f66366cbe3fc6d7742571187442ba... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M configure.ac M libknet/crypto_gcrypt.c M libknet/crypto_nss.c M libknet/crypto_openssl.c
Log Message: ----------- CVE-2026-15811: encryption key exposure in memory after cryptographic configuration changes
Severity: LOW
Wipe cryptographic keys before freeing to prevent exposure through memory disclosure vulnerabilities using explicit_bzero().
Wipe private_key buffers in openssl/gcrypt backends and instance structures in all backends.
The explicit_bzero() function is now required by kronosnet. All modern Linux distributions (glibc >= 2.25, musl >= 1.1.20) and BSDs provide this function.
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: e13cb431329417b530277593a4094ef8bb0572d1 https://github.com/kronosnet/kronosnet/commit/e13cb431329417b530277593a4094e... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M libknet/handle.c M libknet/onwire_v1.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c M libknet/threads_rx.c
Log Message: ----------- CVE-2026-15812: access control list bypass via link ID spoofing on unencrypted dynamic links
Severity: LOW
Exploitable only with unencrypted traffic (not supported for production).
Validate that packets originate from the configured source address for the claimed link_id. Previously, link_id was trusted without verification, allowing attackers to probe link states or confuse failover logic.
Implement secure-by-default model with proper static/dynamic link handling: - Enable use_access_lists=1 by default in knet_handle_new - Static links: always validate against auto-configured ACL - Dynamic links with use_access_lists=1 (default): require ACL or reject - Dynamic links with use_access_lists=0: skip validation (explicit opt-out)
Add bounds check, source address verification, and centralized _check_rx_acl(). Update tests to reflect secure-by-default model.
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: f1e8e1c536a8340fa154b097fc69dadaef7a366a https://github.com/kronosnet/kronosnet/commit/f1e8e1c536a8340fa154b097fc69da... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M libknet/tests/Makefile.am A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c
Log Message: ----------- CVE-2026-15813: memory corruption and out-of-bounds access via malformed network packet defragmentation
Severity: MEDIUM
Validate fragment sequence numbers before accessing defragmentation buffers. Previous code used unchecked sequence numbers as array indices, allowing heap buffer overflow.
Exploitable only with unencrypted traffic (not supported for production).
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: 38258b1be497077e8dd63ad97df356f639a8703c https://github.com/kronosnet/kronosnet/commit/38258b1be497077e8dd63ad97df356... Author: Fabio Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M configure.ac M libknet/crypto_gcrypt.c M libknet/crypto_nss.c M libknet/crypto_openssl.c M libknet/handle.c M libknet/onwire_v1.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c
Log Message: ----------- Merge pull request #499 from kronosnet/security-fixes-cve-only
Security fixes: CVE-2026-15811, CVE-2026-15812, CVE-2026-15813
Compare: https://github.com/kronosnet/kronosnet/compare/45470b8f0ed7...38258b1be497
To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications