Vulnerability feed

Executive summary

The advisory says ConnMan through version 2.0 contains a stack-based buffer overflow that can be triggered by a DHCPv6 Reply message. The provided text is mainly a 2013 git commit that adds domain search list parsing to the DHCPv6 client, and it does not state a severity rating or a vendor recommendation.

Technical summary

The flaw is described as a stack-based buffer overflow, triggered through a DHCPv6 Reply message handled by the gdhcp client code. The quoted commit adds a get_domains function in gdhcp/client.c that copies data into a fixed-size stack buffer (char dns_name[NS_MAXDNAME + 1]) using strncpy with a length of NS_MAXDNAME and then walks the value buffer using length bytes taken from the packet. The advisory does not state the attack vector details beyond a DHCPv6 Reply message, the required network position, or whether authentication is needed. Affected versions are stated only as through 2.0, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/pub/scm/network/connman/…4fb4b03fe2a12420d280

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affects

ConnManConnMan