From d2dd9dcc7369e78f47d01ace19af3750cd89ae66 Mon Sep 17 00:00:00 2001 From: Adam Honse Date: Wed, 12 Aug 2026 08:54:50 -0500 Subject: [PATCH] Address security issues in release_candidate_1.0rc3 - CVE-2026-59682: OpenRGB: arbitrary file overwrite and deletion local and remote - CVE-2026-59683: OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings - CVE-2026-18794: OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite --- NetworkClient.cpp | 6 +++++- NetworkProtocol.h | 7 ++++++- NetworkServer.cpp | 7 ++++++- ProfileManager.cpp | 6 +++--- StringUtils.cpp | 29 +++++++++++++++++++++++++++++ StringUtils.h | 1 + qt/openrgb.service | 12 +++++++++++- 7 files changed, 61 insertions(+), 7 deletions(-) diff --git a/NetworkClient.cpp b/NetworkClient.cpp index a6a1b7c3e..c5b43cae4 100644 --- a/NetworkClient.cpp +++ b/NetworkClient.cpp @@ -515,7 +515,11 @@ void NetworkClient::ListenThreadFunction() /*---------------------------------------------------------*\ | Header received, now receive the data | \*---------------------------------------------------------*/ - if(header.pkt_size > 0) + if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE) + { + goto listen_done; + } + else if(header.pkt_size > 0) { bytes_read = 0; diff --git a/NetworkProtocol.h b/NetworkProtocol.h index 041220c8e..e20f8b3bc 100644 --- a/NetworkProtocol.h +++ b/NetworkProtocol.h @@ -27,7 +27,12 @@ /*-----------------------------------------------------*\ | Default Interface to bind to. | \*-----------------------------------------------------*/ -#define OPENRGB_SDK_HOST "0.0.0.0" +#define OPENRGB_SDK_HOST "127.0.0.1" + +/*-----------------------------------------------------*\ +| Default max packet size is 8MB | +\*-----------------------------------------------------*/ +#define OPENRGB_SDK_MAX_PACKET_SIZE (1024 * 1024 * 8) /*-----------------------------------------------------*\ | Default OpenRGB SDK port is 6742 | diff --git a/NetworkServer.cpp b/NetworkServer.cpp index 8d9f0eb73..31300a414 100644 --- a/NetworkServer.cpp +++ b/NetworkServer.cpp @@ -627,7 +627,12 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info) | Header received, now receive the data | \*---------------------------------------------------------*/ bytes_read = 0; - if(header.pkt_size > 0) + if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE) + { + LOG_ERROR("[NetworkServer] received too large packet, closing listener"); + goto listen_done; + } + else if(header.pkt_size > 0) { data = new char[header.pkt_size]; diff --git a/ProfileManager.cpp b/ProfileManager.cpp index 72fe6f557..137ce15bc 100644 --- a/ProfileManager.cpp +++ b/ProfileManager.cpp @@ -66,7 +66,7 @@ bool ProfileManager::SaveProfile(std::string profile_name, bool sizes) /*---------------------------------------------------------*\ | Open an output file in binary mode | \*---------------------------------------------------------*/ - filesystem::path profile_path = configuration_directory / filesystem::u8path(filename); + filesystem::path profile_path = configuration_directory / filesystem::u8path(StringUtils::make_filename(filename)); std::ofstream controller_file(profile_path, std::ios::out | std::ios::binary | std::ios::trunc); /*---------------------------------------------------------*\ @@ -149,7 +149,7 @@ std::vector ProfileManager::LoadProfileToList unsigned int controller_size; unsigned int controller_offset = 0; - filesystem::path filename = configuration_directory / filesystem::u8path(profile_name); + filesystem::path filename = configuration_directory / filesystem::u8path(StringUtils::make_filename(profile_name)); /*---------------------------------------------------------*\ | Determine file extension | @@ -437,7 +437,7 @@ void ProfileManager::DeleteProfile(std::string profile_name) { profile_name = StringUtils::remove_null_terminating_chars(profile_name); - filesystem::path filename = configuration_directory / profile_name; + filesystem::path filename = configuration_directory / StringUtils::make_filename(profile_name); filename.concat(".orp"); filesystem::remove(filename); diff --git a/StringUtils.cpp b/StringUtils.cpp index c388bee50..9ece1c75b 100644 --- a/StringUtils.cpp +++ b/StringUtils.cpp @@ -22,6 +22,7 @@ #include #include #include +#include #include #include "StringUtils.h" @@ -113,6 +114,34 @@ std::string StringUtils::u32int_to_hexString(unsigned int value) return std::string(hex_str); } +std::string StringUtils::make_filename(std::string input) +{ + /*-----------------------------------------------------*\ + | Replace : characters with - characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex(":"), "-"); + + /*-----------------------------------------------------*\ + | Remove all other characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), ""); + + /*-----------------------------------------------------*\ + | Remove leading . characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("^\\.+"), ""); + + /*-----------------------------------------------------*\ + | Remove control characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), ""); + + /*-----------------------------------------------------*\ + | Return complete string | + \*-----------------------------------------------------*/ + return(input); +} + std::string StringUtils::normalize_hex_id(const std::string& id) { std::string out; diff --git a/StringUtils.h b/StringUtils.h index dab199f1c..cde1ec5b1 100644 --- a/StringUtils.h +++ b/StringUtils.h @@ -20,5 +20,6 @@ public: static std::string u16string_to_string(const std::u16string wstring); static const std::string remove_null_terminating_chars(std::string input); static std::string u32int_to_hexString(unsigned int value); + static std::string make_filename(std::string input); static std::string normalize_hex_id(const std::string& id); }; diff --git a/qt/openrgb.service b/qt/openrgb.service index 4fcca6fc5..abbf233ad 100644 --- a/qt/openrgb.service +++ b/qt/openrgb.service @@ -3,10 +3,20 @@ Description=OpenRGB SDK Server After=network.target lm_sensors.service [Service] -ExecStart=/usr/bin/openrgb --server --config /etc/openrgb +ExecStart=/usr/bin/openrgb --server --noautoconnect --config /etc/openrgb Restart=always RuntimeDirectory=openrgb WorkingDirectory=/run/openrgb +ProtectSystem=strict +ProtectHome=true + +PrivateDevices=false +ProtectKernelTunables=false +ProtectControlGroups=false + +ReadWritePaths=/etc/openrgb +ReadWritePaths=/run/openrgb + [Install] WantedBy=multi-user.target