CVE-2018-9336: Double Free
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-9336?
CVE-2018-9336 is a vulnerability in OpenVPN 2.4.x before 2.4.6 that allows a local attacker to cause a double-free of memory, potentially leading to denial-of-service or other impacts.
How severe is CVE-2018-9336?
CVE-2018-9336 has a severity rating of 7.8 (High).
Which software versions are affected by CVE-2018-9336?
OpenVPN 2.4.x before 2.4.6 and Slackware Linux versions 13.0, 13.1, 13.37, 14.0, and 14.1 are affected by CVE-2018-9336.
How can CVE-2018-9336 be fixed?
To fix CVE-2018-9336, users should upgrade to OpenVPN version 2.4.6 or later.
Where can I find more information about CVE-2018-9336?
More information about CVE-2018-9336 can be found at the following references: Slackware Security Advisory, OpenVPN Wiki, and OpenVPN GitHub commit.