On Thu, 06 Aug 2026 20:37:49 +0200, Shahriyar Jalayeri wrote:
> The DHCPv6 client takes the SERVERID and CLIENTID option lengths from a
> received ADVERTISE/REPLY without bounding them. The SERVERID length is
> later copied unbounded into the fixed net_tx_packet buffer when the
> REQUEST is built (an out-of-bounds write), and the CLIENTID length
> drives a memcmp against the fixed client-DUID buffer (an out-of-bounds
> read).
> Both are reachable by any on-link attacker that answers a DHCPv6 SOLICIT
> during netboot.
>
> [...]
Applied to u-boot-net branch for-main, thanks!
[1/2] net: dhcp6: bound received DUID option lengths
commit: 806a22de450c945db76a1eb4c96aaa2c0e8b2a21
[2/2] test: dm: eth: add DHCPv6 oversized option regression tests
commit: bee6e6485868342de8ef5de528cf1e2a7b741ce7
Best regards,
--
Jerome Forissier <[email protected]>
