SecBoard
Zurück zur CVE-Übersicht

CVE-2026-53922

MEDIUM(6.5)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score16/100 — NIEDRIG
  • CVSS 6.5 — Mittel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • v25.12.5

Threat-Hunting-Queries

Detection for unauthenticated remote denial of service in odhcpd via crafted DHCPv6 RENEW packets leading to a size_t underflow and stack buffer overflow. Focus on unusual DHCPv6 RENEW packet structures or high frequency of RENEW packets from a single source.

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "Dhcpv6Renew" // Placeholder for DHCPv6 RENEW events
| where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") // Exclude private IPs
| summarize EventCount = count() by RemoteIP, bin(Timestamp, 5m)
| where EventCount > 10 // Threshold for frequent RENEW packets, adjust as needed
| project Timestamp, RemoteIP, EventCount,
  "Possible DHCPv6 RENEW flood attempt related to CVE-2026-53922" as AlertMessage

Splunk SPL

sourcetype=dhcpv6 (eventtype=renew OR message=*RENEW*) NOT (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16)
|  stats count as EventCount by src_ip, _time span=5m
|  where EventCount > 10
|  eval AlertMessage="Possible DHCPv6 RENEW flood attempt related to CVE-2026-53922"
|  table _time, src_ip, EventCount, AlertMessage

Sigma

title: odhcpd DHCPv6 RENEW Underflow DoS
status: experimental
description: Detects potential exploitation of CVE-2026-53922 in odhcpd via unusual DHCPv6 RENEW packet patterns.
references:
  - https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5
logsource:
  category: network
  product: dhcp
detection:
  selection:
    event_type: dhcpv6_renew
    # Further conditions for crafted packet structure would be needed here if available in logs
  timeframe: 5m
  condition: selection | stats count() as event_count by source_ip | where event_count > 10
  falsepositives:
    - Legitimate high DHCPv6 RENEW traffic (e.g., network changes, device reconfigurations)
level: medium

Elastic ES|QL

from network_traffic
| where event.category == "network" and event.type == "dhcpv6_renew"
| where not cidrMatch(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| summarize event_count = count() by source.ip, span(timestamp, 5m)
| where event_count > 10
| project timestamp, source.ip, event_count, AlertMessage = "Possible DHCPv6 RENEW flood attempt related to CVE-2026-53922"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Sonstige (3)

  • _SiCk@afflicted.sh
  • dyingc@gmail.com
  • mail@david-bauer.net

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen