CVE-2026-79900 in BoKS Manager
Summary
by MITRE • 10/01/2026
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in boks_ksllogsd represents a critical memory corruption flaw rooted in improper input validation within the Key Server Login protocol implementation. The service accepts a checksum algorithm identifier from an authenticated client during the KSL start message exchange, specifically within the MD field. While the software correctly verifies that OpenSSL recognizes the provided digest name string, it fails to perform essential bounds checking on the length of this value relative to the fixed-size context buffer allocated for storing the checksum data. This oversight creates a scenario where the application assumes that any valid algorithm identifier will result in a manageable output size, ignoring the fact that certain cryptographic hash functions produce digests significantly larger than the sixteen-byte limit imposed by the protocol's structural constraints.
From a technical perspective, this flaw constitutes an out-of-bounds write vulnerability, which aligns with CWE-787 and is often associated with improper neutralization of special elements used in an OS command or buffer overflow scenarios depending on exploitation vectors. The core issue lies in the sequence of operations where the application copies the resulting digest into a heap allocation without verifying that the size of the generated hash does not exceed the allocated space. Because the context field is fixed at sixteen bytes, any algorithm producing a digest larger than this threshold will cause data to be written beyond the boundaries of the buffer. This memory corruption can lead to heap overflow conditions, potentially overwriting adjacent metadata or control structures within the heap manager, which compromises the integrity of the application's memory layout and stability.
The operational impact of this vulnerability is severe due to its potential for remote code execution despite requiring authentication. Although an attacker must first authenticate to interact with boks_ksllogsd, many enterprise environments may have weak or default credentials on administrative services, making exploitation feasible in practice. By supplying a carefully crafted oversized digest name that triggers the overflow, an authenticated user can corrupt heap memory structures such as chunk headers or pointers. This corruption allows for arbitrary read and write primitives, which are foundational steps in achieving remote code execution. The attacker could potentially escalate privileges to root if the service runs with elevated permissions, thereby gaining full control over the host system and compromising all data processed by the Key Server Login infrastructure.
Mitigation strategies should focus on immediate patching of the affected software release to ensure that input validation includes strict length checks against the fixed buffer size before any copying operations occur. Developers must enforce that the digest output size is strictly less than or equal to sixteen bytes for accepted algorithms, rejecting any algorithm identifier that would result in a larger hash output. In addition to code fixes, organizations should implement network segmentation to restrict access to boks_ksllogsd services only from trusted management networks and enforce strong authentication policies with multi-factor authentication where possible. Monitoring logs for unusual patterns of KSL start messages or failed authentication attempts can also aid in early detection of exploitation attempts while patches are being deployed across the environment.