RIOT-OS missing dhcpv6_opt_t minimum header length check
Summary
RIOT-OS missing dhcpv6_opt_t minimum header length check
Original description
The description as published by the source.
RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function _parse_advertise, located in /sys/net/application_layer/dhcpv6/client.c, has no minimum header length check for dhcpv6_opt_t after processing dhcpv6_msg_t. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function _preparse_advertise, which is called by _parse_advertise before handling the request. As of time of publication, no known patched version exists.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov