| Severity |
|
| Remote |
|
| Type |
| + |
Arbitrary code execution |
|
| Description |
| + |
An out-of-bounds write has been found in the dhcpv6 option handing code of systemd-networkd up to and including v239. |
| + |
|
| + |
It was discovered that systemd-network does not correctly keep track of a buffer size in the dhcp6_option_append_ia() function, when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim's one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim's machine. The overflow can be triggered relatively easy by advertising a DHCPv6 server with a server-id >= 493 characters long. |
|
| References |
| + |
https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921 |
| + |
https://github.com/systemd/systemd/pull/10518 |
| + |
https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20 |
|
| Notes |
|