REDHAT-BUG-2531347: Medium severity BusyBox DHCP client vulnerability
A vulnerability was found in the BusyBox DHCP client (networking/udhcp/dhcpc.c), specifically in d4recvrawpacket(). The function trusts the attacker-controlled IP totlen field to calculate the payload size. When a malicious DHCP packet is sent with IP totlen set to 20, the subtraction underflows to a negative value, wraps to a massive unsigned value, and is passed to memcpy(), causing an immediate segfault.
Remote code execution is not practical because the oversized memcpy faults immediately. The attack requires Layer 2 network adjacency.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must have Layer 2 network adjacency to the affected DHCP client, allowing them to send a malicious DHCP packet on the same local network segment.
What is the expected impact of successful exploitation?
A malicious packet with an IP tot_len value of 20 causes an integer underflow that leads to an oversized memcpy() and an immediate segmentation fault. Remote code execution is not considered practical because the copy faults immediately.