CVE-2022-0324 Exploit Metadata

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

The artifact contains a Python script (exploit.py) that crafts and sends a malicious DHCPv6 RELAY-REPL packet with an oversized option length to a target IP and port, intended to trigger a buffer overflow in dhcp6relay as described in CVE-2022-0324.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Dockerfile, README, and a Python exploit script for CVE-2022-0324. The exploit script constructs and sends a DHCPv6 relay-reply packet with an oversized option length to trigger a buffer overflow in dhcp6relay, consistent with the described vulnerability. No concealed backdoor, persistence, credential theft, or unrelated payload is present in the reviewed text files.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPythonDockerfile

Target softwaredhcp6relaySONiC

Attack typesbuffer overflow

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit.py actively constructs and sends a malicious network packet designed to exploit CVE-2022-0324, which is a buffer overflow vulnerability. This is direct exploitation code, not a scanner or writeup.

exploit.py:1-20

Requirements

Target running vulnerable dhcp6relay service on UDP port 547 at the specified IPv6 address.exploit.py:4-5exploit.py:18-20
Python 3 environment with socket support.exploit.py:1-2

Observed behavior

Constructs a DHCPv6 RELAY-REPL message with a crafted OPTION_RELAY_MSG option where the length field is set to 65535 (0xFFFF), exceeding the actual data length, to trigger a buffer overflow in memcpy.exploit.py:10-16
Sends the crafted packet via IPv6 UDP to the target address 2a00:7b80:451:1::10 on port 547.exploit.py:18-20

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script: exploit.py sends a crafted DHCPv6 packet to a hardcoded IPv6 address on port 547Demonstrates the CVE-2022-0324 buffer overflow by sending a packet with option_length set to 65535 and a payload of 2^15 bytes, which can trigger an out-of-bounds write in dhcp6relay.exploit.py:1-20
Build Environment: Dockerfile builds dhcp6relay from sonic-buildimage commit bcf5388 and copies the exploit scriptSets up a vulnerable environment for reproducing CVE-2022-0324, including building the affected component and configuring Redis.Dockerfile:1-44
External Reference: https://ngtuonghung.github.io/pwn/cve-reproduction/cve-2022-0324/README points to an external blog post likely detailing the vulnerability reproduction, but the content is not included in the evidence.README.md:1-3

Review boundaries

What the analysis did not establish

The Dockerfile and README.md provide build and reference context but do not contain exploit logic.
The evidence does not include the add_ipv6_addresses.sh script or the full repository contents.
The exploit script targets a hardcoded IP address and may not be directly usable without modification.
The file add_ipv6_addresses.sh is referenced in the Dockerfile but its content is not provided in the evidence. Its behavior cannot be assessed.
The external blog post linked in README.md is not included and its content is unknown.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

Repository root

Created 2025-11-09Vuln labCVE-2022-0324Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker environment based on Ubuntu 20.04 that builds a specific commit of sonic-buildimage, compiles the dhcp6relay component with debug symbols, configures a local Redis server, and copies an IPv6 setup script and a Python exploit script into the image.

Dockerfile:1-44

Lab assessment

Vulnerability lab

The README explicitly references CVE-2022-0324 and links to a CVE reproduction article. The Dockerfile builds a vulnerable component (dhcp6relay) from a specific commit and includes an exploit script (exploit.py) that sends a crafted DHCPv6 relay reply packet, consistent with a vulnerability reproduction environment.

README.md:1-3Dockerfile:1-44exploit.py:1-20

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Dockerfile

environment definitionbuild instructions

Defines the container image: installs build dependencies, clones sonic-buildimage at commit bcf5388, builds and installs sonic-swss-common, compiles dhcp6relay with debug flags, configures Redis, and copies add_ipv6_addresses.sh and exploit.py.

Dockerfile:1-44

add_ipv6_addresses.sh

network configurationlab setup

A shell script that restarts Redis, creates a VLAN interface on eth0, assigns IPv6 addresses, brings the interface up, and sets a Redis key for DHCP relay configuration. It prepares the network environment for the dhcp6relay service.

add_ipv6_addresses.sh:1-6

exploit.py

exploit scriptproof-of-concept

A Python script that crafts a DHCPv6 relay reply packet with a large option length (65535) and sends it to a local IPv6 address on port 547. This is the exploit payload targeting the dhcp6relay component.

exploit.py:1-20

dhcp6relay (built from source)

vulnerable targetDHCPv6 relay agent

The dhcp6relay binary is compiled from sonic-buildimage source with debug symbols. It is the target of the exploit, presumably vulnerable to CVE-2022-0324.

Dockerfile:24-30

Redis server

configuration storedependency

A local Redis server is installed and configured to listen on a Unix socket. It stores DHCP relay configuration used by dhcp6relay.

Dockerfile:33-37add_ipv6_addresses.sh:1-6

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-0324

Supported by supplied evidence

The README explicitly states the repository is for CVE-2022-0324 and links to a reproduction article. The Dockerfile builds a specific commit of sonic-buildimage containing dhcp6relay, and the exploit script sends a malformed DHCPv6 relay reply, consistent with the CVE description (a buffer overflow in dhcp6relay).

README.md:1-3Dockerfile:1-44exploit.py:1-20

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build the image.Dockerfile:1
The container must be run with appropriate network capabilities (e.g., --cap-add=NET_ADMIN) to allow creation of VLAN interfaces and assignment of IPv6 addresses.add_ipv6_addresses.sh:2-5
The dhcp6relay service must be started inside the container before running the exploit.Dockerfile:24-30

Evidence-described exercise path

Build the Docker image using the provided Dockerfile.Dockerfile:1-44
Run a container from the image, likely with --privileged or --cap-add=NET_ADMIN to allow network configuration.add_ipv6_addresses.sh:2-5
Execute add_ipv6_addresses.sh inside the container to set up the VLAN interface, IPv6 addresses, and Redis configuration.add_ipv6_addresses.sh:1-6
Start the dhcp6relay service inside the container.Dockerfile:24-30
Run the exploit script (exploit.py) to send a crafted DHCPv6 relay reply packet to the local dhcp6relay service.exploit.py:1-20

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (dhcp6relay) within the container. The exploit sends a packet to a local IPv6 address on the container's own interface. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

exploit.py:1-20add_ipv6_addresses.sh:1-6Dockerfile:1-44

Review boundaries

What the analysis did not establish

The Dockerfile does not include a CMD or ENTRYPOINT to start dhcp6relay automatically; the exercise path requires manual steps.
The exploit script uses a hardcoded destination IPv6 address that matches the address configured in add_ipv6_addresses.sh, but the script does not verify that the target service is running.
The dhcp6relay binary is built from source but its behavior is not inspected; the analysis relies on the CVE association and script intent.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2022-0324