| Description |
An out-of-bounds write has been found in the dhcpv6 option handing code of systemd-networkd up to and including v239.
It was discovered that systemd-network does not correctly keep track of a buffer size in the dhcp6_option_append_ia() function, when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim's one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim's machine. The overflow can be triggered relatively easy by advertising a DHCPv6 server with a server-id >= 493 characters long. |