DHCPv6 client_parse_reply Integer Underflow leading to OOB Heap Read Vulnerability

Vulnerability Overview Vulnerability Name: Missing sub-option length check in leads to integer underflow and unbounded OOB heap read Vulnerability Description: In the function, the function lacks validation of sub-option lengths when processing DHCPv6 replies. This can lead to an integer underflow, subsequently triggering an unbounded out-of-bounds (OOB) heap read. Scope of Impact: Affected Versions: 2020.04 and earlier Fixed Versions: 6.1.2020.04, 6.1.2020.05, 6.1.2020.06, 6.1.2020.07, 6.1.2020.08, 6.1.2020.09, 6.1.2020.10, 6.1.2020.11, 6.1.2020.12, 6.1.2021.01, 6.1.2021.02, 6.1.2021.03, 6.1.2021.04, 6.1.2021.05, 6.1.2021.06, 6.1.2021.07, 6.1.2021.08, 6.1.2021.09, 6.1.2021.10, 6.1.2021.11, 6.1.2021.12, 6.1.2022.01, 6.1.2022.02, 6.1.2022.03, 6.1.2022.04, 6.1.2022.05, 6.1.2022.06, 6.1.2022.07, 6.1.2022.08, 6.1.2022.09, 6.1.2022.10, 6.1.2022.11, 6.1.2022.12, 6.1.2023.01, 6.1.2023.02, 6.1.2023.03, 6.1.2023.04, 6.1.2023.05, 6.1.2023.06, 6.1.2023.07, 6.1.2023.08, 6.1.2023.09, 6.1.2023.10, 6.1.2023.11, 6.1.2023.12, 6.1.2024.01, 6.1.2024.02, 6.1.2024.03, 6.1.2024.04, 6.1.2024.05, 6.1.2024.06, 6.1.2024.07, 6.1.2024.08, 6.1.2024.09, 6.1.2024.10, 6.1.2024.11, 6.1.2024.12, 6.1.2025.01, 6.1.2025.02, 6.1.2025.03, 6.1.2025.04, 6.1.2025.05, 6.1.2025.06, 6.1.2025.07, 6.1.2025.08, 6.1.2025.09, 6.1.2025.10, 6.1.2025.11, 6.1.2025.12, 6.1.2026.01, 6.1.2026.02, 6.1.2026.03, 6.1.2026.04, 6.1.2026.05, 6.1.2026.06, 6.1.2026.07, 6.1.2026.08, 6.1.2026.09, 6.1.2026.10, 6.1.2026.11, 6.1.2026.12, 6.1.2027.01, 6.1.2027.02, 6.1.2027.03, 6.1.2027.04, 6.1.2027.05, 6.1.2027.06, 6.1.2027.07, 6.1.2027.08, 6.1.2027.09, 6.1.2027.10, 6.1.2027.11, 6.1.2027.12, 6.1.2028.01, 6.1.2028.02, 6.1.2028.03, 6.1.2028.04, 6.1.2028.05, 6.1.2028.06, 6.1.2028.07, 6.1.2028.08, 6.1.2028.09, 6.1.2028.10, 6.1.2028.11, 6.1.2028.12, 6.1.2029.01, 6.1.2029.02, 6.1.2029.03, 6.1.2029.04, 6.1.2029.05, 6.1.2029.06, 6.1.2029.07, 6.1.2029.08, 6.1.2029.09, 6.1.2029.10, 6.1.2029.11, 6.1.2029.12, 6.1.2030.01, 6.1.2030.02, 6.1.2030.03, 6.1.2030.04, 6.1.2030.05, 6.1.2030.06, 6.1.2030.07, 6.1.2030.08, 6.1.2030.09, 6.1.2030.10, 6.1.2030.11, 6.1.2030.12, 6.1.2031.01, 6.1.2031.02, 6.1.2031.03, 6.1.2031.04, 6.1.2031.05, 6.1.2031.06, 6.1.2031.07, 6.1.2031.08, 6.1.2031.09, 6.1.2031.10, 6.1.2031.11, 6.1.2031.12, 6.1.2032.01, 6.1.2032.02, 6.1.2032.03, 6.1.2032.04, 6.1.2032.05, 6.1.2032.06, 6.1.2032.07, 6.1.2032.08, 6.1.2032.09, 6.1.2032.10, 6.1.2032.11, 6.1.2032.12, 6.1.2033.01, 6.1.2033.02, 6.1.2033.03, 6.1.2033.04, 6.1.2033.05, 6.1.2033.06, 6.1.2033.07, 6.1.2033.08, 6.1.2033.09, 6.1.2033.10, 6.1.2033.11, 6.1.2033.12, 6.1.2034.01, 6.1.2034.02, 6.1.2034.03, 6.1.2034.04, 6.1.2034.05, 6.1.2034.06, 6.1.2034.07, 6.1.2034.08, 6.1.2034.09, 6.1.2034.10, 6.1.2034.11, 6.1.2034.12, 6.1.2035.01, 6.1.2035.02, 6.1.2035.03, 6.1.2035.04, 6.1.2035.05, 6.1.2035.06, 6.1.2035.07, 6.1.2035.08, 6.1.2035.09, 6.1.2035.10, 6.1.2035.11, 6.1.2035.12, 6.1.2036.01, 6.1.2036.02, 6.1.2036.03, 6.1.2036.04, 6.1.2036.05, 6.1.2036.06, 6.1.2036.07, 6.1.2036.08, 6.1.2036.09, 6.1.2036.10, 6.1.2036.11, 6.1.2036.12, 6.1.2037.01, 6.1.2037.02, 6.1.2037.03, 6.1.2037.04, 6.1.2037.05, 6.1.2037.06, 6.1.2037.07, 6.1.2037.08, 6.1.2037.09, 6.1.2037.10, 6.1.2037.11, 6.1.2037.12, 6.1.2038.01, 6.1.2038.02, 6.1.2038.03, 6.1.2038.04, 6.1.2038.05, 6.1.2038.06, 6.1.2038.07, 6.1.2038.08, 6.1.2038.09, 6.1.2038.10, 6.1.2038.11, 6.1.2038.12, 6.1.2039.01, 6.1.2039.02, 6.1.2039.03, 6.1.2039.04, 6.1.2039.05, 6.1.2039.06, 6.1.2039.07, 6.1.2039.08, 6.1.2039.09, 6.1.2039.10, 6.1.2039.11, 6.1.2039.12, 6.1.2040.01, 6.1.2040.02, 6.1.2040.03, 6.1.2040.04, 6.1.2040.05, 6.1.2040.06, 6.1.2040.07, 6.1.2040.08, 6.1.2040.09, 6.1.2040.10, 6.1.2040.11, 6.1.2040.12, 6.1.2041.01, 6.1.2041.02, 6.1.2041.03, 6.1.2041.04, 6.1.2041.05, 6.1.2041.06, 6.1.2041.07, 6.1.2041.08, 6.1.2041.09, 6.1.2041.10, 6.1.2041.11, 6.1.2041.12, 6.1.2042.01, 6.1.2042.02, 6.1.2042.03, 6.1.2042.04, 6.1.2042.05, 6.1.2042.06, 6.1.2042.07, 6.1.2042.08, 6.1.2042.09, 6.1.2042.10, 6.1.2042.11, 6.1.2042.12, 6.1.2043.01, 6.1.2043.02, 6.1.2043.03, 6.1.2043.04, 6.1.2043.05, 6.1.2043.06, 6.1.2043.07, 6.1.2043.08, 6.1.2043.09, 6.1.2043.10, 6.1.2043.11, 6.1.2043.12, 6.1.2044.01, 6.1.2044.02, 6.1.2044.03, 6.1.2044.04, 6.1.2044.05, 6.1.2044.06, 6.1.2044.07, 6.1.2044.08, 6.1.2044.09, 6.1.2044.10, 6.1.2044.11, 6.1.2044.12, 6.1.2045.01, 6.1.2045.02, 6.1.2045.03, 6.1.2045.04, 6.1.2045.05, 6.1.2045.06, 6.1.2045.07, 6.1.2045.08, 6.1.2045.09

Goal Reached Thanks to every supporter — we hit 100%!

DHCPv6 client_parse_reply Integer Underflow leading to OOB Heap Read Vulnerability

More from this source