CVE-2022-0324

HIGH

Buffer Overflow in Dhcp6relay in Software for Open Networking in the Cloud (SONiC)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-0324 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown. Discovered by Eugene Lim of GovTech Singapore.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Software for Open Networking in the Cloud (SONiC)

Browse Linux Foundation / Software for Open Networking in the Cloud (SONiC)

Default status: unaffected

CVE List202111affected

Proofs of concept

1

Repository PoCs

GitHubngtuonghung/CVE-2022-0324Repository PoCby ngtuonghung0Exploit4 files

2.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit.py) that crafts and sends a malicious DHCPv6 RELAY-REPL packet with an oversized option length to a target IP and port, intended to trigger a buffer overflow in dhcp6relay as described in CVE-2022-0324.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Dockerfile, README, and a Python exploit script for CVE-2022-0324. The exploit script constructs and sends a DHCPv6 relay-reply packet with an oversized option length to trigger a buffer overflow in dhcp6relay, consistent with the described vulnerability. No concealed backdoor, persistence, credential theft, or unrelated payload is present in the reviewed text files.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonDockerfile
Target softwaredhcp6relaySONiC
Attack typesbuffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit.py actively constructs and sends a malicious network packet designed to exploit CVE-2022-0324, which is a buffer overflow vulnerability. This is direct exploitation code, not a scanner or writeup.

exploit.py:1-20

Requirements

  • Target running vulnerable dhcp6relay service on UDP port 547 at the specified IPv6 address.exploit.py:4-5exploit.py:18-20
  • Python 3 environment with socket support.exploit.py:1-2

Observed behavior

  • Constructs a DHCPv6 RELAY-REPL message with a crafted OPTION_RELAY_MSG option where the length field is set to 65535 (0xFFFF), exceeding the actual data length, to trigger a buffer overflow in memcpy.exploit.py:10-16
  • Sends the crafted packet via IPv6 UDP to the target address 2a00:7b80:451:1::10 on port 547.exploit.py:18-20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script
Payload withheldDemonstrates the CVE-2022-0324 buffer overflow by sending a packet with option_length set to 65535 and a payload of 2^15 bytes, which can trigger an out-of-bounds write in dhcp6relay.exploit.py:1-20
Build Environment
Payload withheldSets up a vulnerable environment for reproducing CVE-2022-0324, including building the affected component and configuring Redis.Dockerfile:1-44
External Reference
Payload withheldREADME points to an external blog post likely detailing the vulnerability reproduction, but the content is not included in the evidence.README.md:1-3
Review boundaries

What the analysis did not establish

  • The Dockerfile and README.md provide build and reference context but do not contain exploit logic.
  • The evidence does not include the add_ipv6_addresses.sh script or the full repository contents.
  • The exploit script targets a hardcoded IP address and may not be directly usable without modification.
  • The file add_ipv6_addresses.sh is referenced in the Dockerfile but its content is not provided in the evidence. Its behavior cannot be assessed.
  • The external blog post linked in README.md is not included and its content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

ngtuonghung/CVE-2022-0324Created Vuln labCVE-2022-0324Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker environment based on Ubuntu 20.04 that builds a specific commit of sonic-buildimage, compiles the dhcp6relay component with debug symbols, configures a local Redis server, and copies an IPv6 setup script and a Python exploit script into the image.

Dockerfile:1-44

Lab assessment

Vulnerability lab

The README explicitly references CVE-2022-0324 and links to a CVE reproduction article. The Dockerfile builds a vulnerable component (dhcp6relay) from a specific commit and includes an exploit script (exploit.py) that sends a crafted DHCPv6 relay reply packet, consistent with a vulnerability reproduction environment.

README.md:1-3Dockerfile:1-44exploit.py:1-20
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

environment definitionbuild instructions

Defines the container image: installs build dependencies, clones sonic-buildimage at commit bcf5388, builds and installs sonic-swss-common, compiles dhcp6relay with debug flags, configures Redis, and copies add_ipv6_addresses.sh and exploit.py.

Dockerfile:1-44

add_ipv6_addresses.sh

network configurationlab setup

A shell script that restarts Redis, creates a VLAN interface on eth0, assigns IPv6 addresses, brings the interface up, and sets a Redis key for DHCP relay configuration. It prepares the network environment for the dhcp6relay service.

add_ipv6_addresses.sh:1-6

exploit.py

exploit scriptproof-of-concept

A Python script that crafts a DHCPv6 relay reply packet with a large option length (65535) and sends it to a local IPv6 address on port 547. This is the exploit payload targeting the dhcp6relay component.

exploit.py:1-20

dhcp6relay (built from source)

vulnerable targetDHCPv6 relay agent

The dhcp6relay binary is compiled from sonic-buildimage source with debug symbols. It is the target of the exploit, presumably vulnerable to CVE-2022-0324.

Dockerfile:24-30

Redis server

configuration storedependency

A local Redis server is installed and configured to listen on a Unix socket. It stores DHCP relay configuration used by dhcp6relay.

Dockerfile:33-37add_ipv6_addresses.sh:1-6
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-0324

Supported by supplied evidence

The README explicitly states the repository is for CVE-2022-0324 and links to a reproduction article. The Dockerfile builds a specific commit of sonic-buildimage containing dhcp6relay, and the exploit script sends a malformed DHCPv6 relay reply, consistent with the CVE description (a buffer overflow in dhcp6relay).

README.md:1-3Dockerfile:1-44exploit.py:1-20
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image.Dockerfile:1
  • The container must be run with appropriate network capabilities (e.g., --cap-add=NET_ADMIN) to allow creation of VLAN interfaces and assignment of IPv6 addresses.add_ipv6_addresses.sh:2-5
  • The dhcp6relay service must be started inside the container before running the exploit.Dockerfile:24-30

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-44
  2. Run a container from the image, likely with --privileged or --cap-add=NET_ADMIN to allow network configuration.add_ipv6_addresses.sh:2-5
  3. Execute add_ipv6_addresses.sh inside the container to set up the VLAN interface, IPv6 addresses, and Redis configuration.add_ipv6_addresses.sh:1-6
  4. Start the dhcp6relay service inside the container.Dockerfile:24-30
  5. Run the exploit script (exploit.py) to send a crafted DHCPv6 relay reply packet to the local dhcp6relay service.exploit.py:1-20
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (dhcp6relay) within the container. The exploit sends a packet to a local IPv6 address on the container's own interface. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

exploit.py:1-20add_ipv6_addresses.sh:1-6Dockerfile:1-44
Review boundaries

What the analysis did not establish

  • The Dockerfile does not include a CMD or ENTRYPOINT to start dhcp6relay automatically; the exercise path requires manual steps.
  • The exploit script uses a hardcoded destination IPv6 address that matches the address configured in add_ipv6_addresses.sh, but the script does not verify that the target service is running.
  • The dhcp6relay binary is built from source but its behavior is not inspected; the analysis relies on the CVE association and script intent.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3