CVE-2026-54579 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The import utility serves as the package manager for MidnightBSD, relying on network connectivity to verify mirror availability and latency before selecting a repository source. The vulnerability resides within the ping implementation located in libmport/ping.c, where the code fails to perform adequate validation of incoming Internet Control Message Protocol replies. Specifically, the function accepts ICMP echo reply packets without verifying that the identifier or sequence number fields match those sent in the original request. This lack of stateful correlation allows any network observer capable of injecting or spoofing visible ICMP traffic to manipulate the perceived responsiveness of potential mirrors. By sending crafted responses with artificially low latency metrics, an attacker can trick the package manager into selecting a compromised or malicious mirror for subsequent software updates and dependency downloads.
Beyond the logical flaw in response validation, there is a critical memory safety issue related to IP header parsing. The code utilizes a fixed offset to locate the ICMP header within the received packet rather than dynamically calculating it based on the Internet Header Length field found in the IPv4 header. This approach assumes that packets will always contain no optional fields or extensions. If an attacker crafts a malformed IP packet containing options, the actual start of the ICMP data shifts relative to the fixed offset used by the parser. Consequently, when the application attempts to read from this incorrect memory location, it triggers an out-of-bounds read operation. This type of error falls under CWE-125 Out-of-bounds Read and can potentially lead to information disclosure if sensitive memory contents are leaked through subsequent processing or logging mechanisms, although in many cases it may simply result in a denial of service via application crash due to invalid memory access.
The operational impact of these flaws is significant for the integrity of the software supply chain on MidnightBSD systems. The ability to spoof ICMP replies enables an attacker to perform man-in-the-middle style attacks against package updates, potentially redirecting users toward malicious repositories that host trojanized binaries or malware. This aligns with ATT&CK technique T1589 Gather Victim Identity Information and T1602 Software Supply Chain Compromise if the goal is long-term persistence through compromised packages. The out-of-bounds read represents a secondary vector for exploitation, potentially allowing an attacker to crash the import process during routine maintenance tasks or gather internal system information depending on how the parsed data is handled after the initial read.
Mitigation strategies primarily involve upgrading the MidnightBSD package manager to version 2.7.8 or later, where these validation and parsing errors have been corrected. In this updated release, the ping function properly validates ICMP identifier and sequence numbers against sent requests to ensure response authenticity. Furthermore, the IP header length is now correctly parsed using the ip_hl field to determine the precise offset of the ICMP payload, preventing out-of-bounds memory access when packets contain options. For systems that cannot immediately upgrade, network-level controls such as ingress filtering (BCP38) can help mitigate spoofing attacks by ensuring that source IP addresses in incoming traffic match expected ranges for legitimate mirrors. Additionally, deploying intrusion detection signatures targeting malformed ICMP packets with unusual header lengths may provide early warning of exploitation attempts against unpatched systems.