Vulnerability · Published Nov 14, 2022 · Assigned by GovTech CSG
CVE-2022-0324Buffer Overflow in Dhcp6relay in Software for Open Networking in the Cloud (SONiC)
High 8.1
In plain English
A high-severity buffer overflow in Software for Open Networking in the Cloud (SONiC) from Linux Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown. Discovered by Eugene Lim of GovTech Singapore.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux Foundation | Software for Open Networking in the Cloud (SONiC) | 202111 |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H