Threats tagged 'ghsa-6p28-q7pv-rxcx'

A stack-based buffer overflow vulnerability exists in the udhcpc6 DHCPv6 client component of BusyBox due to improper validation of network option sizes. A malicious DHCPv6 server on the local network can exploit this flaw by sending crafted replies, potentially leading to arbitrary code execution with root privileges or denial of service (DoS) crashes. This vulnerability primarily affects environments where BusyBox's udhcpc6 is explicitly used for IPv6 network configuration, such as specialized or embedded systems. Standard Red Hat Enterprise Linux installations are not typically exposed as they use NetworkManager instead of BusyBox for DHCP. No effective mitigation or patch is currently available that meets Red Hat's criteria for ease of use and stability.