Executive brief
wicked is a network configuration daemon used on Linux systems to manage network interfaces and DHCP settings. An unauthenticated attacker on the same network can send a specially crafted DHCP packet to trigger an out-of-bounds memory read of up to 68 bytes beyond the packet buffer. While this does not allow direct data exfiltration, heap memory contents such as allocator metadata could be leaked through the DHCP client response, potentially aiding further attacks.
Technical details
The vulnerability is an out-of-bounds read in the DHCPv4 packet capture code of wicked, specifically in the ni_capture_inspect_udp_header() function in src/capture.c. The function incorrectly uses the IP total length field as the UDP payload length, rather than calculating the remaining UDP payload length. This causes the DHCP option walker in the wickedd-dhcp4 client to read up to ihl + 8 bytes (maximum 68 bytes) past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network can trigger this by sending a crafted DHCP/UDP packet, allowing the DHCP client to parse adjacent heap memory as DHCP options and potentially leak allocator metadata or pointer values into lease fields. No memory write or remote exfiltration mechanism has been demonstrated. A patch is available via openSUSE/wicked Pull Request #1079.
Affected products
- openSUSE wicked up to and including 0.6.80
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Patch merged in PR #1079