CVE-2025-70102: Null Pointer Dereference
A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcpopt' and aborts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70102?
The severity of CVE-2025-70102 is rated as medium with a CVSS score of 6.3.
How do I fix CVE-2025-70102?
To fix CVE-2025-70102, update to a version of Roy Marples Dhcpcd that addresses the NULL pointer dereference issue.
What causes the NULL pointer dereference in CVE-2025-70102?
The NULL pointer dereference in CVE-2025-70102 is caused by parsing configuration options in an unexpected or invalid state.
Which software is affected by CVE-2025-70102?
CVE-2025-70102 affects the Roy Marples Dhcpcd software version 10.3.0 and earlier.
What type of vulnerability is CVE-2025-70102 classified as?
CVE-2025-70102 is classified as a NULL pointer dereference vulnerability.