REDHAT-BUG-2458518: High severity ISC DHCPv6 (helper process in helper.c) vulnerability
In helper.c:265, the DHCPv6 CLID is hex-encoded via sprintf("%.2x") into daemon->packet (5,131 bytes) with no length cap on the CLID. DHCPv6 CLIDs can be up to 65,535 bytes (131,070 hex characters). The helper process retains root privileges. log6packet() already caps CLID to 100 bytes for logging, but the helper code path was missed. Fix: add && i < 100 bound to the encoding loop, matching the logging cap.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2458518?
The severity of REDHAT-BUG-2458518 is high, rated at 7.
How do I fix REDHAT-BUG-2458518?
To fix REDHAT-BUG-2458518, update to the latest version of ISC DHCPv6 that addresses the vulnerability.
What are the potential risks associated with REDHAT-BUG-2458518?
The potential risks include buffer overflow and remote exploitation due to unbounded input handling in the DHCPv6 CLID.
In which software is REDHAT-BUG-2458518 found?
REDHAT-BUG-2458518 is found in the ISC DHCPv6 helper process in helper.c.
What part of the code is affected in REDHAT-BUG-2458518?
The affected part of the code is helper.c at line 265, where DHCPv6 CLID processing occurs.