CVE-2020-11810: 
OpenVPN vulnerability analysis and mitigation

CVE-2020-11810 is a security vulnerability discovered in OpenVPN 2.4.x versions before 2.4.9. The vulnerability was disclosed in April 2020 and affects the data channel packet handling mechanism in OpenVPN. This vulnerability specifically impacts OpenVPN installations that use Negotiable Cipher Parameters (NCP) (NVD).

The vulnerability stems from a race condition between allocating peer-id and initializing data channel key. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id during a small time window between the victim client connection starting and the server PUSH_REPLY response. The issue occurs because tls_pre_decrypt() sets packet length to zero if data channel key has not been initialized, leading to openvpn_decrypt() returning true for zero-length packets, which then triggers process_incoming_link_part1() to process the float request (OpenVPN Patch, GitHub Commit). The vulnerability has been assigned a CVSS v3.1 Base Score of 3.7 (Low) (NVD).

If successfully exploited, the vulnerability results in a denial of service condition where the victim's VPN connection is dropped. However, the attacker cannot inject or steal VPN traffic from the session as they do not have access to the suitable encryption keys. The impact is limited to disrupting individual client connections (SUSE Bugzilla).

The vulnerability requires precise timing for exploitation, as the attack must occur within a small time window (usually within a few seconds) between the client connection initiation and the server's PUSH_REPLY response. Additionally, the attack only works when Negotiable Cipher Parameters (NCP) is in use. The vulnerability cannot be used to target specific client sessions unless there is another way to force them to disconnect and reconnect (Fedora Update).

The vulnerability was fixed in OpenVPN version 2.4.9 by adding a buffer length check before calling multi_process_float(). The fix ensures that only packets with valid, decrypted content can trigger address floating. Users are recommended to upgrade to OpenVPN 2.4.9 or later versions (GitHub Commit).