OpenBSD 8.0 errata 003 – aesgmac

openbsd 8.0 · errata 003

2026-10-20 · common

When IPsec is used with AES-GMAC, a kernel heap overflow could be triggered remotely. Only amd64 with AES-NI and octeon with crypto coprocessor are affected. AES-GCM is not affected.

installera

# syspatch

binär patch finns för amd64

källpatch

signify -Vep /etc/signify/openbsd-80-base.pub -x 003_aesgmac.patch.sig \
    -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
KK=`sysctl -n kern.osversion | cut -d# -f1`
cd /usr/src/sys/arch/`machine`/compile/$KK
make obj
make config
make
make install

länkar

003_aesgmac.patch.sig
errata80.html