OpenWrt 25.12.4 - Service Release

Release and security announcements
21

Yet another critical kernel vulnerability in Linux kernel - probably we should expect next bugfix release quite soon :joy:

6 Likes
22

Well…if anyone has unauthorized access to openwrt that would be with the root account to begin with, so using an exploit from root to root would not make much sense.

For any other distributions sure, they need to patch ASAP

4 Likes
23

What about services running from non-root users? E.g. dnsmasq, wireless subsystem?

24

Let's hope they'll be fixed in a reasonable amount of time (at least the security issues, this one and the one with dropbear)...

let's hope for a 25.12.5 now

2 Likes
25

There are no human non-root users to be concerned about.

As long as there’s no RCE allowing you to gain access to a non-root account that you could use to escalate to root there’s nothing to worry.

26

As if there was no RCE in dnsmasq which was fixed in 25.12.4...

1 Like
27

dnsmasq shouldn’t be allowed on the internet, whether we’re talking about the original or the pi-hole fork…

28

But it is allowed to every LAN user. Some OpenWrts serve hundreds of users... Not all of them are well-behaved.

1 Like
29

I’ve no issues with internal use. It’s just that there’s better options there for resolving DNS

30

CVE 2024-1488 - welcome.

31

For whomever lives in 2024

32

All my Filogic (Flint 2, AP3000 and Zyxel NW50AX Pro) targets are failing to update with wget errors. Tried with ASU, owut and firmware selector creating custom package. All fail.

33

thanks for the release :tada:

waiting for the 802.11r Fast Transition (FT) fix.

2 Likes
34

About the implementation on the ASU server: does the wget command retry a few times on error code 8, or does it fail immediately? If it fails immediately, can a few retries be added?

35

Many off-the-shelf routers do live in 2024 and even earlier. These kernel vulnerabilities will live and get exploited (for bad and good) for quite a long time...

36

We need to see the complete error message.

37

Fritzbox 4040 upgraded from .3 via luci app, all ok.

38

After multiple retries I have been able to update with owut, error was wget error 8 sometimes said package EOF error and other times said impossible package selection. Error was never constant.

39

Update went smooth on my Gl.Inet GL-MT6000 (flint2) by using two simple commands. The first one to check and the 2nd to run the update.

owut check --verbose --version-to 25.12.4 
owut upgrade --verbose --version-to 25.12.4

The issue with my WAN not getting a IPV4 since the update from v24 version v25 can be solved as well:

# /etc/config/network
uci set network.wan.broadcast='1'
uci set network.wan.clientid='1111CXX11111' #example of a MAC
uci set network.wan.multipath='off'
1 Like
40

I got some error messages when updating via OWUT.

However after switching to
https://sysupgrade.guerra24.net/ as Sysupgrade server is could update without issues.

All APs/switches are updated and running well. Thanks again devs!

2 Likes