Bug#1142049: trixie-pu: package dhcpcd/10.1.0-11+deb13u4

Martin-Éric Racine <[email protected]>
Newsgroups gmane.linux.debian.devel.release
Message-ID <178402970748.13336.11295420087688282026.reportbug__7664.49452364526$1784029893$gmane$org@p8b75.internal> 
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:dhcpcd
User: [email protected]
Usertags: pu

[ Reason ]
Backporting a fix for one minor CVE reported on the Debian security tracker.

CVE-2026-14258 was fixed in 10.2.0 (Sid has 10.3.2) but never backported until now.

[ Impact ]
Without it, successful exploitation of the CVE may result in excessive CPU consumption, leading to a denial of service.

[ Tests ]
Verified to boot on a host running Trixie.

[ Risks ]
Small. A few lines of code.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
.
  * [patches]
    + Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca).
    = Refresh all patches.
debdiff_11+deb13u3_11+deb13u4.txt (text/plain, 5.6 KB) 
diff -Nru dhcpcd-10.1.0/debian/changelog dhcpcd-10.1.0/debian/changelog
--- dhcpcd-10.1.0/debian/changelog	2026-06-26 18:23:21.000000000 +0300
+++ dhcpcd-10.1.0/debian/changelog	2026-07-14 14:36:11.000000000 +0300
@@ -1,3 +1,11 @@
+dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
+
+  * [patches]
+    + Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca).
+    = Refresh all patches.
+
+ -- Martin-Éric Racine <[email protected]>  Tue, 14 Jul 2026 14:36:11 +0300
+
 dhcpcd (1:10.1.0-11+deb13u3) trixie; urgency=medium
 
   * [patches] (Closes: #1140767)
diff -Nru dhcpcd-10.1.0/debian/copyright dhcpcd-10.1.0/debian/copyright
--- dhcpcd-10.1.0/debian/copyright	2026-06-26 18:08:05.000000000 +0300
+++ dhcpcd-10.1.0/debian/copyright	2026-07-14 14:33:14.000000000 +0300
@@ -92,7 +92,7 @@
 
 Files: debian/*
 Copyright: 2023, Andreas Beckmann <[email protected]>
- 2022-2025, Martin-Éric Racine <[email protected]>
+ 2022-2026, Martin-Éric Racine <[email protected]>
  2018, Scott Leggett <[email protected]>
  2015, Daniel Echeverry <[email protected]>
  2014, Salvatore Bonaccorso <[email protected]>
diff -Nru dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
--- dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch	1970-01-01 02:00:00.000000000 +0200
+++ dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch	2026-07-14 14:33:15.000000000 +0300
@@ -0,0 +1,71 @@
+From 75289ca54211481d21b0c915db98dd733b30794f Mon Sep 17 00:00:00 2001
+From: Roy Marples <[email protected]>
+Date: Sat, 7 Dec 2024 10:25:44 +0000
+Subject: [PATCH] IPv6: Discard NA packets with a zero length option
+
+As per RFC 4861 4.6.
+
+Fixes #415.
+---
+ src/ipv6nd.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/src/ipv6nd.c
++++ b/src/ipv6nd.c
+@@ -974,6 +974,12 @@
+ 	bool new_ia;
+ #endif
+ 
++#define FREE_RAP(rap)					\
++	if (new_rap)					\
++		ipv6nd_removefreedrop_ra(rap, 0, 0);	\
++	else						\
++		ipv6nd_free_ra(rap);			\
++
+ 	if (ifp == NULL || RS_STATE(ifp) == NULL) {
+ #ifdef DEBUG_RS
+ 		logdebugx("RA for unexpected interface from %s", sfrom);
+@@ -1130,8 +1136,10 @@
+ 		memcpy(&ndo, p, sizeof(ndo));
+ 		olen = (size_t)ndo.nd_opt_len * 8;
+ 		if (olen == 0) {
++			/* RFC4681 4.6 says we MUST discard this ND packet. */
+ 			logerrx("%s: zero length option", ifp->name);
+-			break;
++			FREE_RAP(rap);
++			return;
+ 		}
+ 		if (olen > len) {
+ 			logerrx("%s: option length exceeds message",
+@@ -1155,10 +1163,7 @@
+ 			else
+ 				logwarnx("%s: reject RA (option %d) from %s",
+ 				    ifp->name, ndo.nd_opt_type, rap->sfrom);
+-			if (new_rap)
+-				ipv6nd_removefreedrop_ra(rap, 0, 0);
+-			else
+-				ipv6nd_free_ra(rap);
++			FREE_RAP(rap);
+ 			return;
+ 		}
+ 
+@@ -1409,10 +1414,7 @@
+ 		{
+ 			logwarnx("%s: reject RA (no option %s) from %s",
+ 			    ifp->name, dho->var, rap->sfrom);
+-			if (new_rap)
+-				ipv6nd_removefreedrop_ra(rap, 0, 0);
+-			else
+-				ipv6nd_free_ra(rap);
++			FREE_RAP(rap);
+ 			return;
+ 		}
+ 	}
+@@ -1494,6 +1496,7 @@
+ 
+ 	/* Expire should be called last as the rap object could be destroyed */
+ 	ipv6nd_expirera(ifp);
++#undef FREE_RAP
+ }
+ 
+ bool
diff -Nru dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
--- dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch	2026-06-26 18:13:59.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch	2026-07-14 14:33:15.000000000 +0300
@@ -16,7 +16,7 @@
 +++ b/src/dhcpcd.conf
 @@ -34,11 +34,6 @@
  # Most distributions have NTP support.
- option ntp_servers
+ #option ntp_servers
  
 -# Rapid commit support.
 -# Safe to enable by default because it requires the equivalent option set
diff -Nru dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
--- dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch	2026-06-26 18:13:58.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch	2026-07-14 14:33:15.000000000 +0300
@@ -15,5 +15,5 @@
 -#option ntp_servers
 +option ntp_servers
  
- # Rapid commit support.
- # Safe to enable by default because it requires the equivalent option set
+ # A ServerID is required by RFC2131.
+ require dhcp_server_identifier
diff -Nru dhcpcd-10.1.0/debian/patches/series dhcpcd-10.1.0/debian/patches/series
--- dhcpcd-10.1.0/debian/patches/series	2026-06-26 18:13:25.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/series	2026-07-14 14:33:15.000000000 +0300
@@ -1,5 +1,4 @@
 Debian_uncomment_hostname_in_dhcpcd_conf.patch
-Debian_uncomment_ntp_servers_dhcpcd_conf.patch
 25689325f81c7a61bd48f5727eaae1d6f16e1328.patch
 2870767a79537b5d6918e7de80358b406fea0898.patch
 fdeb8c7945211d424c3a30912004eeb56e009865.patch
@@ -7,9 +6,15 @@
 79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
 6acf895a66b143c42308777e085c1511cdebe5e0.patch
 5db90127b1c3128480a52559a9cdbd4949a0fed4.patch
+#10.1.0-11+deb13u1
 eac7152ec04f5a330f01ab9504514a03f873b35c.patch
+#10.1.0-11+deb13u2
+Debian_uncomment_ntp_servers_dhcpcd_conf.patch
+#10.1.0-11+deb13u3
 117742d755b591764036dd4218f314f748a3d2b7.patch
 2f00c7bfc408b6582d331932dfa47829c4819029.patch
 5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
 78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
+#10.1.0-11+deb13u4
+75289ca54211481d21b0c915db98dd733b30794f.patch
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.