Out-of-Bounds write in systemd-networkd dhcpv6 option handling

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• canonical ubuntu linux16.04
• canonical ubuntu linux18.04
• canonical ubuntu linux18.10
• debian debian linux8.0
• redhat enterprise linux desktop7.0
• redhat enterprise linux server7.0
• redhat enterprise linux server aus7.6
• redhat enterprise linux server eus7.6
• redhat enterprise linux server tus7.6
• redhat enterprise linux workstation7.0
• systemd project systemdup to 239 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (canonical). Independent of NVD's CPE analysis and usually ahead of it.

• systemd systemd

  • unspecified and later · up to and including 239affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-9445In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small.
  46Plan
• CVE-2018-21029systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS.
  40Plan
• CVE-2015-7510Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
  40Plan
• CVE-2017-1000082systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g.
  40Plan
• CVE-2022-2526A use-after-free vulnerability was found in systemd.
  39Monitor
• CVE-2017-15908In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in th
  37Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.