Exploitation Summary
EIP tracks 2 public exploits for CVE-2020-7461. PoCs published by knqyf263, 0xkol.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2020-7461, a DHCP vulnerability (NAME:WRECK) in FreeBSD. The exploit causes a DoS by sending a malformed DHCP ACK packet with an invalid forward pointer in the DHCP Domain Search option, leading to a segmentation fault in the victim's dhclient.
Description
In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.
Exploits (2)
This repository contains a functional PoC for CVE-2020-7461, a DHCP vulnerability (NAME:WRECK) in FreeBSD. The exploit causes a DoS by sending a malformed DHCP ACK packet with an invalid forward pointer in the DHCP Domain Search option, leading to a segmentation fault in the victim's dhclient.
This repository contains a functional PoC for CVE-2020-7461, a heap-based buffer overflow in FreeBSD's dhclient when parsing DHCP option 119. The exploit leverages a compression scheme flaw in the `find_search_domain_name_len` function to trigger a buffer overrun.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L