CVE-2026-54579: mport mirror-selection ping accepts insufficiently validated ICMP replies
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mport (MidnightBSD Package Manager) ping() in libmport/ping.cto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Who is exposed to mirror-selection manipulation?
Systems running mport before 2.7.8 are exposed when an attacker can inject or spoof ICMP replies that are visible to the mport ping operation. Such replies can influence the latency measurements used for mirror selection.
What conditions are required to trigger the out-of-bounds read?
An attacker needs to provide a malformed ICMP reply with IP options that changes the IP header length. The vulnerable code uses a fixed IP-header offset rather than the actual ip_hl value when locating the ICMP header.
How can I determine whether my installation is affected?
Check the installed mport version. Versions prior to 2.7.8 are affected; version 2.7.8 contains the fix.
What should be done if patching cannot happen immediately?
The available information identifies exploitation as requiring injected or spoofed visible ICMP replies. Reducing the ability of untrusted network parties to send or spoof ICMP traffic visible to the affected host can reduce exposure until mport is updated.