CVE-2016-1504

The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, allowing remote DHCP servers to cause a denial of service via a crafted response.

The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.

The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.

dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

A use-after-free vulnerability in dhcpcd through version 10.3.2, fixed in commit 78ea09e, exists in control socket handling in src/control.c. Local unprivileged attackers can trigger memory corruption when privilege separation is disabled by sending a privileged command (e.g., -x) to the control socket.

A memory leak vulnerability in dhcpcd through version 10.3.2, fixed in commit 708b4a5, exists in IPv6 Router Advertisement route information handling. An unauthenticated same-link attacker can cause denial of service by sending crafted Router Advertisements, leading to linear memory exhaustion and daemon crash.

A vulnerability in dhcpcd up to version 10.3.2 (fixed in commit 2f00c7b) allows an unauthenticated same-link attacker to perform a one-byte stack out-of-bounds write by sending a crafted DHCPv6 ADVERTISE message with an OPTION_PD_EXCLUDE option using prefix lengths /121 to /128. The flaw resides in dhcp6_makemessage() in src/dhcp6.c and can corrupt adjacent stack memory.

In dhcpcd up to version 10.3.2, a heap use-after-free vulnerability allows an unauthenticated same-link attacker to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.