CVE-2026-115863
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | A | Adjacent network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | L | Low |
| Integrity I | L | Low |
| Availability A | H | High |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Description
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.1 | 7.6 HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| CNA / mitre | 3.1 | 7.6 HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| ConnMan | ConnMan | affected: 0 … <= 2.0 default: unknown |
Linux distribution status
References (3)
- https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280 NVD, CNA product
- https://git.kernel.org/pub/scm/network/connman/connman.git/tree/gdhcp/client.c NVD, CNA product
- https://lore.kernel.org/connman/[email protected]/ NVD, CNA third-party-advisory