[SECURITY] U-Boot: unvalidated IPv6 UDP length in net_ip6_handler() yields pre-auth OOB write / RCE via the DHCPv6 client (net/net6.c, net/dhcpv6.c)

Hi,

There is a pre-authentication out-of-bounds write in the IPv6 receive
path, reachable from a single link-local DHCPv6 ADVERTISE.
net_ip6_handler() (net/net6.c:426, :442) passes the wire-supplied UDP
length to the DHCPv6 client without checking it against the number of
bytes actually received.
The client then acts on that length: dhcp6_send_request_packet()
(net/dhcpv6.c:244) copies an attacker-declared number of bytes past
the net_pkt_buf transmit buffer.
When the copy overruns onto the push_packet function pointer
(net/net.c:1201), U-Boot calls it on the next received frame, which
runs that frame's bytes as a command line via run_command().
The result is pre-authentication remote code execution in the bootloader.
CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8).

I reproduced this two ways:
  - QEMU qemu_arm64 over virtio-net: an injected command (e.g. "echo
...") runs and prints on the console.
  - Physical Raspberry Pi 4 (bcmgenet): the same ADVERTISE redirects
the program counter to the planted run_command address. The
Synchronous-Abort elr equals the injected value.

A device that netboots over DHCPv6 is reached over the network alone,
with no credentials and no user interaction.
The IPv4 path already does the length reconciliation the IPv6 path is
missing (net/net.c:1303, :1379). The fix is to port those checks to
net_ip6_handler(); a suggested patch is in the attached write-up.

Attached is a self-contained proof of concept: build and run
instructions, the exploit, the controls, and console transcripts.
(AI was used to automate the identification of this vuln, but I've
confirmed the results manually)

Thanks,
Aniziki
[email protected]