On Tue, Aug 04, 2026 at 05:22:32PM -0500, Esteban Alba wrote: > Hi, > > There is a pre-authentication out-of-bounds write in the IPv6 receive > path, reachable from a single link-local DHCPv6 ADVERTISE. > net_ip6_handler() (net/net6.c:426, :442) passes the wire-supplied UDP > length to the DHCPv6 client without checking it against the number of > bytes actually received. > The client then acts on that length: dhcp6_send_request_packet() > (net/dhcpv6.c:244) copies an attacker-declared number of bytes past > the net_pkt_buf transmit buffer. > When the copy overruns onto the push_packet function pointer > (net/net.c:1201), U-Boot calls it on the next received frame, which > runs that frame's bytes as a command line via run_command(). > The result is pre-authentication remote code execution in the bootloader. > CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). > > I reproduced this two ways: > - QEMU qemu_arm64 over virtio-net: an injected command (e.g. "echo > ...") runs and prints on the console. > - Physical Raspberry Pi 4 (bcmgenet): the same ADVERTISE redirects > the program counter to the planted run_command address. The > Synchronous-Abort elr equals the injected value. > > A device that netboots over DHCPv6 is reached over the network alone, > with no credentials and no user interaction. > The IPv4 path already does the length reconciliation the IPv6 path is > missing (net/net.c:1303, :1379). The fix is to port those checks to > net_ip6_handler(); a suggested patch is in the attached write-up. > > Attached is a self-contained proof of concept: build and run > instructions, the exploit, the controls, and console transcripts. > (AI was used to automate the identification of this vuln, but I've > confirmed the results manually)
As I just replied to someone else, it's much more valuable to work on addressing the issue and following https://docs.u-boot.org/en/latest/develop/sending_patches.html to submit the fix, than it is to just generate a report, thanks. -- Tom
signature.asc
Description: PGP signature
