EUVD-2026-38498
GHSA-p284-r695-7gxf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only access with high complexity due to required non-default privsep-disabled configuration; low privileges to connect; availability-only impact from daemon crash with no confidentiality or integrity consequence.
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.
AnalysisAI
Heap use-after-free in dhcpcd through version 10.3.2 allows local unprivileged attackers to crash the DHCP client daemon by exploiting a double-free race between READ and HANGUP events on the control socket. When an attacker sends a privileged command such as -x, control_recvdata() frees the client fd_list object while the subsequent HANGUP event delivers the same stale pointer to control_hangup(), triggering memory corruption that results in denial of network service on the affected host. No public exploit code or CISA KEV listing exists at time of analysis; the upstream fix is available as commit 78ea09e.
Technical ContextAI
dhcpcd is a portable DHCP client daemon (CPE: cpe:2.3:a:networkconfiguration:dhcpcd:*:*:*:*:*:*:*:*) that exposes a Unix domain control socket for runtime management. The root cause is CWE-416 (Use After Free) in src/control.c: the original code allowed control_recvdata() - which previously had a void return type - to call control_free() to release the fd_list client object, while the same epoll/kqueue event loop could subsequently deliver a HANGUP event to control_hangup() referencing the now-deallocated pointer. The commit 78ea09e fixes this by changing control_recvdata() to return an int error code, restructuring the event dispatch in control_handle_read() to propagate that return value upward, and centralizing all cleanup through a single goto hangup label so the fd_list object is freed exactly once. Privilege separation (privsep), when functioning, isolates the control socket handler in a dedicated subprocess, making the vulnerable code path unreachable by unprivileged callers.
RemediationAI
Upgrade dhcpcd to a version incorporating upstream commit 78ea09ed1633a583dbcde6e7bab9df4639ec8a34 (https://github.com/NetworkConfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34) once distribution packages are available; an exact patched release tag is not confirmed from current data. The VulnCheck advisory at https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-via-control-socket-handling provides additional vendor context. As an immediate compensating control, verify that privilege separation is active by ensuring --disable-privsep is not passed to dhcpcd and that privsep initialization completes successfully at startup - this removes the vulnerable code path entirely. Additionally, restrict control socket filesystem permissions so that the socket does not operate in mode 0666; limiting access to root or a dedicated group prevents unprivileged users from connecting, though this may break management tools or scripts that depend on world-accessible socket access. Restarting dhcpcd with privsep confirmed active is the most effective interim mitigation before patching.
dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-0
dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature. Rated c
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses. Rated critical s
Stack out-of-bounds write in dhcpcd (the widely-used DHCP/DHCPv6 client) through version 10.3.2 lets a same-link attacke
Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a deni
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related t
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP ser
Denial of service in dhcpcd through version 10.3.2 allows an adjacent-network attacker to exhaust memory in the daemon b
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SLES-CHOST-BYOS-Aliyun | Affected |
| SLES-CHOST-BYOS-Azure | Affected |
| SLES-CHOST-BYOS-EC2 | Affected |
| SLES-CHOST-BYOS-GCE | Affected |
| SLES-CHOST-BYOS-GDC | Affected |
| SLES-CHOST-BYOS-SAP-CCloud | Affected |
Share
External POC / Exploit Code
Leaving vuln.today