CVE-2024-1305: 
OpenVPN vulnerability analysis and mitigation

A memory overflow vulnerability (CVE-2024-1305) was discovered in the tap-windows6 driver version 9.26 and earlier, specifically in the Terminal Access Point (TAP) adapter used by OpenVPN. The vulnerability stems from improper size checking of incoming write operations, which could lead to memory buffer overflow (Debian Tracker, CERT-EU).

The vulnerability resides in the Windows Terminal Access Point (TAP) driver, specifically in the device.c file within the project's src folder where the TAP device object and its initialization code is located. The flaw manifests as an integer overflow bug in the !TapSharedSendPacket function (SecurityOnline, CERT-EU).

If exploited, this vulnerability could result in memory corruption and system crashes, potentially leading to arbitrary code execution in kernel space (Debian Tracker, SecurityOnline).

The vulnerability is one of four flaws discovered in OpenVPN that could be chained together to achieve remote code execution (RCE) and local privilege escalation (LPE). Exploitation requires user authentication and an advanced understanding of OpenVPN's inner workings (Hacker News).

The vulnerability has been patched in OpenVPN version 2.6.10 and the TAP driver has been updated to version 9.27.0. Users are strongly advised to update to the latest version as soon as possible to mitigate the risk (Mail Archive).

The vulnerability was discovered and reported by Vladimir Tokarev from Microsoft's Threat Intelligence Community. Microsoft has published a detailed analysis of this vulnerability along with the other OpenVPN flaws, highlighting the potential security implications when these vulnerabilities are chained together (Hacker News).