CVE-2018-15688 log

Source
Severity Critical
Remote Yes
Type Arbitrary code execution
Description
An out-of-bounds write has been found in the dhcpv6 option handing code of systemd-networkd up to and including v239.

It was discovered that systemd-network does not correctly keep track of a buffer size  in the dhcp6_option_append_ia() function, when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim's one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim's machine. The overflow can be triggered relatively easy by advertising a DHCPv6 server with a server-id >= 493 characters long.
Group Package Affected Fixed Severity Status Ticket
AVG-789 systemd 239.2-1 239.300-1 Critical Fixed FS#60609
Date Advisory Group Package Severity Description
07 Nov 2018 ASA-201811-11 AVG-789 systemd Critical multiple issues
References
https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921
https://github.com/systemd/systemd/pull/10518
https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20