Re: [SECURITY] U-Boot: unvalidated IPv6 UDP length in net_ip6_handler() yields pre-auth OOB write / RCE via the DHCPv6 client (net/net6.c, net/dhcpv6.c)

On Tue, Aug 04, 2026 at 05:22:32PM -0500, Esteban Alba wrote:

> Hi,
> 
> There is a pre-authentication out-of-bounds write in the IPv6 receive
> path, reachable from a single link-local DHCPv6 ADVERTISE.
> net_ip6_handler() (net/net6.c:426, :442) passes the wire-supplied UDP
> length to the DHCPv6 client without checking it against the number of
> bytes actually received.
> The client then acts on that length: dhcp6_send_request_packet()
> (net/dhcpv6.c:244) copies an attacker-declared number of bytes past
> the net_pkt_buf transmit buffer.
> When the copy overruns onto the push_packet function pointer
> (net/net.c:1201), U-Boot calls it on the next received frame, which
> runs that frame's bytes as a command line via run_command().
> The result is pre-authentication remote code execution in the bootloader.
> CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8).
> 
> I reproduced this two ways:
>   - QEMU qemu_arm64 over virtio-net: an injected command (e.g. "echo
> ...") runs and prints on the console.
>   - Physical Raspberry Pi 4 (bcmgenet): the same ADVERTISE redirects
> the program counter to the planted run_command address. The
> Synchronous-Abort elr equals the injected value.
> 
> A device that netboots over DHCPv6 is reached over the network alone,
> with no credentials and no user interaction.
> The IPv4 path already does the length reconciliation the IPv6 path is
> missing (net/net.c:1303, :1379). The fix is to port those checks to
> net_ip6_handler(); a suggested patch is in the attached write-up.
> 
> Attached is a self-contained proof of concept: build and run
> instructions, the exploit, the controls, and console transcripts.
> (AI was used to automate the identification of this vuln, but I've
> confirmed the results manually)

As I just replied to someone else, it's much more valuable to work on
addressing the issue and following
https://docs.u-boot.org/en/latest/develop/sending_patches.html to submit
the fix, than it is to just generate a report, thanks.

-- 
Tom

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTzzqh0PWDgGS+bTHor4qD1Cr/kCgUCanT5pwAKCRAr4qD1Cr/k
CohiAPwMLBVcESwzmX6vuR2P1fAOe5z2u6z8Z/zA95ZSqz4LjQD/fUyUMz++wbIa
/ZHT5dU3vkuCQ8qW67/DtP9vz1lexQ0=
=HA74
-----END PGP SIGNATURE-----