Threats tagged 'ghsa-9f82-ccff-m2qq'

A use-after-free vulnerability exists in BusyBox's udhcpc6 DHCPv6 client. A malicious local network DHCPv6 server can send a crafted reply packet without usable address options, triggering the flaw. This causes the client to read stale heap memory, potentially leading to a denial of service via application crash or disclosure of previously assigned network address data. The vulnerability requires an attacker on the local network and affects environments where BusyBox udhcpc6 is explicitly used, such as custom setups or containers. Standard Red Hat Enterprise Linux installations are not affected as they use NetworkManager by default.