openbsd 7.9 · errata 038
When IPsec is used with AES-GMAC, a kernel heap overflow could be triggered remotely. Only amd64 with AES-NI and octeon with crypto coprocessor are affected. AES-GCM is not affected.
installera
# syspatch
källpatch
signify -Vep /etc/signify/openbsd-79-base.pub -x 038_aesgmac.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install a new kernel:
KK=`sysctl -n kern.osversion | cut -d# -f1`
cd /usr/src/sys/arch/`machine`/compile/$KK
make obj
make config
make
make install