Bug 2496879 (CVE-2026-14612)

Summary: CVE-2026-14612 freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during OAuth2 device authorization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abokovoy, frenaud, ftrivino, rhel-process-autobot, snegrini, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---Flags: snegrini: needinfo? (abokovoy)
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may be able to trigger ipa-otpd to write or read one byte past the end of a fixed-size buffer. Exploitation requires FreeIPA to be configured with an external IdP, attacker control or MITM of that IdP, and a user to initiate the OAuth2 device authorization flow. The most likely impact is limited denial of service affecting the ipa-otpd daemon.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2496886    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-03 14:53:52 UTC 
Two related off-by-one memory safety bugs in the FreeIPA ipa-otpd daemon,
in oauth2_on_child_readable() (daemons/ipa-otpd/oauth2.c). Confirmed by
reporter with AddressSanitizer on minimal reproducers. Verified against
upstream master (2026-07-03): vulnerable code still present.

Bug #1 — Out-of-bounds write (CWE-787), oauth2.c ~line 282
    static char buf[10240];
    io = read(verto_get_fd(ev), buf, 10240);
    if (io >= 0) {
        buf[io] = '\0';   // OOB when io == 10240
    }

Bug #2 — Out-of-bounds read (CWE-125), oauth2.c ~line 305
    rad_reply = memchr(buf, '\n', io);
    if (rad_reply != NULL) {
        *rad_reply = '\0';
        rad_reply++;
        end = memchr(rad_reply, '\n', io - (rad_reply - 1 - buf));  // off by 1
    }

Prerequisites:
1. FreeIPA configured with external IdP (ipa idp-add)
2. Attacker controls IdP endpoint or can MITM IdP traffic
3. A domain user initiates OAuth2 device authorization (kinit / IdP-backed account)

Requirements to exploit:
No FreeIPA admin credentials required on attacker side. Attacker operates at
the IdP layer. User interaction required to start the OAuth2 device flow.
Exploitation preconditions are non-trivial (IdP control/MITM + configured IdP).