[PATCH] net: ipv4: ipconfig: fix OOB read in DHCP option parsing
flat view
WARM2d
REVIEWED: 1 (0M)
From: Liu Chao <hidden>
Date: 2026-10-16 04:12:00
Also in:
lkml
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
1 review trailer.
The DHCP option parser in ic_bootp_recv() advances the option pointer by the option length and only checks that the new pointer has not reached the end of the packet. The length byte and the option payload (opt[1], opt[2]) are then read without verifying that they lie within the buffer, so a malformed reply from a rogue DHCP server can trigger an out-of-bounds read. Validate the option length against the remaining bytes before consuming the option, and skip options that do not fit. This keeps the existing parsing logic intact while ensuring all reads stay within the received packet. Reviewed-by: Guanglei Zhu <redacted> Signed-off-by: Liu Chao <redacted> --- net/ipv4/ipconfig.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 22a788987..0b39a5ccf 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c@@ -1081,25 +1081,27 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str __be32 server_id = NONE; int mt = 0; - ext = &b->exten[4]; - while (ext < end && *ext != 0xff) { - u8 *opt = ext++; - if (*opt == 0) /* Padding */ - continue; - ext += *ext + 1; - if (ext >= end) - break; - switch (*opt) { - case 53: /* Message type */ - if (opt[1]) - mt = opt[2]; - break; - case 54: /* Server ID (IP address) */ - if (opt[1] >= 4) - memcpy(&server_id, opt + 2, 4); - break; + ext = &b->exten[4]; + while (ext < end && *ext != 0xff) { + u8 *opt = ext++; + if (*opt == 0) /* Padding */ + continue; + if (ext >= end) + break; + ext += *ext + 1; + if (ext > end) + break; + switch (*opt) { + case 53: /* Message type */ + if (opt[1]) + mt = opt[2]; + break; + case 54: /* Server ID (IP address) */ + if (opt[1] >= 4) + memcpy(&server_id, opt + 2, 4); + break; + } } - } pr_debug("DHCP: Got message type %d (%s)\n", mt, d->dev->name);
--
2.50.1