A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a<\/p>\n
kilobyte past the end of the received message.<\/p>\n
The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:<\/p>\n
“`c<\/p>\n
\/* addons\/dhcp\/nxd_dhcp_client.c:7538, 7572 *\/<\/p>\n
while (i length byte *\/
\n data += size + 1; \/* data moves size + 1 more *\/
\n i += size + 1; \/* i moves only size + 1 *\/<\/p>\n
}<\/p>\n
“`<\/p>\n
A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so<\/p>\n
the offset falls one byte behind the real read position for every option the walk skips. After<\/p>\n
enough skipped options the check `i < length – 1` still holds while `data` is already past the end<\/p>\n
of the message, and the subsequent read of the type and length bytes comes from whatever follows.<\/p>\n
A single OFFER carrying a long run of skippable options is enough:<\/p>\n
“`<\/p>\n
ERROR: AddressSanitizer: heap-buffer-overflow<\/p>\n
READ of size 1 at 0x61b000000794 thread T5<\/p>\n
#0 _nx_dhcp_search_buffer addons\/dhcp\/nxd_dhcp_client.c:7541
\n #1 _nx_dhcp_get_option_value addons\/dhcp\/nxd_dhcp_client.c:7082<\/p>\n
0x61b000000794 is located 164 bytes to the right of 1648-byte region<\/p>\n
“`<\/p>\n
A well formed OFFER through the same path is handled normally, the client records the offer and<\/p>\n
moves to REQUESTING, so the difference is the option layout rather than the harness.<\/p>\n
The read runs in the DHCP client thread while the client is still unconfigured, so it happens on<\/p>\n
every boot in reach of a hostile DHCP responder. The values read are used to configure the<\/p>\n
interface, which is how the disclosed bytes become observable.<\/p>\n
Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.<\/p>\n","protected":false},"excerpt":{"rendered":"
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a<\/p>\n
kilobyte past the end of the received message.<\/p>\n
The option walk keeps a pointer and an offset in<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30703","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}