dhcp6c 信息泄露漏洞：无效 IA_PD 选项导致越界读取

漏洞概述 漏洞类型: 信息泄露漏洞 漏洞描述: 在 中，当使用 选项读取租约时，如果租约文件包含无效的 选项（选项 24）， 会尝试读取该选项的数据，导致读取超出文件末尾，从而泄露敏感信息。 影响范围 受影响版本: 版本 9.4.0-P1 及更早版本 受影响系统: 使用 的系统，特别是那些使用 选项读取租约文件的系统 修复方案 修复版本: 版本 9.4.0-P2 及更高版本 修复方法: 在读取租约文件时，增加对选项数据的边界检查，防止读取超出文件末尾 POC 代码 ```c / RFC 3315 / 3632: For the DHCPv6 option types: - type 0x00 (IA_NA) and type 0x01 (IA_TA) are valid - type 0x02 (IA_PD) is valid only if the IA_PD option is present - type 0x03 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x04 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x05 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x06 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x07 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x08 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x09 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0A (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0B (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0C (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0D (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0E (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x0F (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x10 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x11 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x12 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x13 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x14 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x15 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x16 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x17 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x18 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x19 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1A (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1B (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1C (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1D (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1E (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x1F (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x20 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x21 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x22 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x23 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x24 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x25 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x26 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x27 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x28 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x29 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2A (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2B (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2C (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2D (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2E (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x2F (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x30 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x31 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x32 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x33 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x34 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x35 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x36 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI option is present - type 0x37 (OPTION_V6_OR_OUI) is valid only if the OPTION_V6_OR_OUI op

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

dhcp6c 信息泄露漏洞：无效 IA_PD 选项导致越界读取

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

dhcp6c 信息泄露漏洞：无效 IA_PD 选项导致越界读取

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！