A flaw was found in libslirp. The DHCPv6 (src/dhcpv6.c) and TFTP (src/tftp.c) response builders write guest-influenced, variable-length data into a reply mbuf sized according to SlirpConfig.ifmtu, without checking that the write stays within that buffer. In dhcpv6inforequest(), a guest-supplied DHCPv6 CLIENTID option (up to 256 bytes, capped independently of ifmtu) is memcpy'd into the reply with no bounds check against the mbuf's actual size, overflowing the heap buffer whenever ifmtu is smaller than the clientid length plus fixed overhead. A related sink in the same function computes a signed 'smaxlen' for the boot-file-URL option that can go negative once earlier options have consumed the MTU window, which, when passed as an unsigned size to slirpfmt(), defeats its length truncation entirely. An analogous pattern exists in tftpreaddata() (src/tftp.c) via the guest-supplied blksize option. These sinks are only reachable when the host/hypervisor operator has configured a small interface MTU (below the IPv6 minimum link MTU of 1280, down to the library's accepted floor of 68); the default MTU of 1500 is not affected.

A flaw was found in libslirp. The DHCPv6 (src/dhcpv6.c) and TFTP (src/tftp.c) response builders write guest-influenced, variable-length data into a reply mbuf sized according to SlirpConfig.ifmtu, without checking that the write stays within that buffer. In dhcpv6inforequest(), a guest-supplied DHCPv6 CLIENTID option (up to 256 bytes, capped independently of ifmtu) is memcpy'd into the reply with no bounds check against the mbuf's actual size, overflowing the heap buffer whenever ifmtu is smaller than the clientid length plus fixed overhead. A related sink in the same function computes a signed 'smaxlen' for the boot-file-URL option that can go negative once earlier options have consumed the MTU window, which, when passed as an unsigned size to slirpfmt(), defeats its length truncation entirely. An analogous pattern exists in tftpreaddata() (src/tftp.c) via the guest-supplied blksize option. These sinks are only reachable when the host/hypervisor operator has configured a small interface MTU (below the IPv6 minimum link MTU of 1280, down to the library's accepted floor of 68); the default MTU of 1500 is not affected.