GHSA-99pw-cp79-2j5j: dhcvpv6 client: Unchecked Server-Side Malicious Packet
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55086 |
Severity |
Medium |
CWE |
|
Published |
2025‑10‑20 |
Last updated |
2025‑10‑20 |
Description
Summary
The dhcpv6 client fails to validate server-side input properly, specifically when extracting the server DUID from the server reply. It can lead to an Out-of-Bounds (OOB) read, which constitutes undefined behavior.
Details
In the function _nx_dhcpv6_process_server_duid located in nxd_dhcpv6_client.c, the client extracts the server’s DUID from the server’s response by parsing the message sequentially. It adjusts the index and calls the _nx_dhcpv6_utility_get_data function to extract data.
Although there is a check for the index position and the message length when parsing the most cases, there is a missing validation check before parsing the lsw. This lack of validation can lead to an OOB read if the server sends a malicious packet with a malformed or truncated message.
file: nxd_dhcpv6_client.c:5815
function: _nx_dhcpv6_process_server_duid
...
else if (temp_hardware_type == NX_DHCPV6_CLIENT_HARDWARE_TYPE_EUI_64)
{
/* The length of link layer address is 64 bits. */
/* Check option length for 64 bits mac address. */
if (index + 8 > option_length)
{
return(NX_DHCPV6_INVALID_SERVER_DUID);
}
/* Yes; Extract the link local address msw which should be the next 4 bytes. */
_nx_dhcpv6_utility_get_data((option_data + index), 4, &temp_msw);
/* Update the index for moving the buffer pointer forward. */
index += 4;
}
/* Missing option length */
/* Yes; Extract the link local address lsw which should be the next 4 bytes. */
_nx_dhcpv6_utility_get_data((option_data + index), 4, &temp_lsw);