CVE-2026-10773
Full vulnerability record from the local CVENow database.
Description
The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type <= sizeof(name) instead of msg_type <= ARRAY_SIZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, 64 on 64-bit targets) rather than the element count of 8, so message-type values from 9 up to that byte size pass the check and cause name[msg_type - 1] to read past the end of the array. The msg_type value originates from the DHCP MESSAGE TYPE option, which is read as an unchecked raw byte from a received packet (net_pkt_read_u8) and passed unmodified into the lookup. A DHCP server, or any host able to inject a spoofed DHCP reply onto the client's link, can therefore drive the index out of bounds. The out-of-range slot yields a garbage const char * that is then dereferenced by a %s log conversion. The lookup is reached only from a debug log statement (NET_DBG / LOG_DBG), so the out-of-bounds read is triggerable only when the DHCPv4 log module is built at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not the default configuration. When that condition holds, the result is an out-of-bounds read and a wild-pointer dereference: most likely a crash of the DHCP client (denial of service) and potentially disclosure of an adjacent pointer's contents through the log output. The fix replaces sizeof with ARRAY_SIZE, restoring the correct 1..8 acceptance window.
View original CVE JSON
{
"id": "CVE-2026-10773",
"sourceIdentifier": "[email protected]",
"published": "2026-08-01T13:16:56.987",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type <= sizeof(name) instead of msg_type <= ARRAY_SIZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, 64 on 64-bit targets) rather than the element count of 8, so message-type values from 9 up to that byte size pass the check and cause name[msg_type - 1] to read past the end of the array.\n\nThe msg_type value originates from the DHCP MESSAGE TYPE option, which is read as an unchecked raw byte from a received packet (net_pkt_read_u8) and passed unmodified into the lookup. A DHCP server, or any host able to inject a spoofed DHCP reply onto the client's link, can therefore drive the index out of bounds. The out-of-range slot yields a garbage const char * that is then dereferenced by a %s log conversion.\n\nThe lookup is reached only from a debug log statement (NET_DBG / LOG_DBG), so the out-of-bounds read is triggerable only when the DHCPv4 log module is built at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not the default configuration. When that condition holds, the result is an out-of-bounds read and a wild-pointer dereference: most likely a crash of the DHCP client (denial of service) and potentially disclosure of an adjacent pointer's contents through the log output. The fix replaces sizeof with ARRAY_SIZE, restoring the correct 1..8 acceptance window."
},
{
"lang": "es",
"value": "El ayudante del cliente DHCPv4 net_dhcpv4_msg_type_name() en subsys/net/lib/dhcpv4/dhcpv4.c indexa una tabla de nombres estática de 8 elementos de tipo const char * después de una comprobación de límites defectuosa. La protección utilizada msg_type <= sizeof(name) en lugar de msg_type <= ARRAY_SIZE(name); sizeof devuelve el tamaño en bytes del array de punteros (32 en objetivos de 32 bits, 64 en objetivos de 64 bits) en lugar del recuento de elementos de 8, por lo que los valores de tipo de mensaje desde 9 hasta ese tamaño en bytes pasan la comprobación y hacen que name[msg_type - 1] lea más allá del final del array.\n\nEl valor msg_type se origina en la opción DHCP MESSAGE TYPE, que se lee como un byte en bruto sin verificar de un paquete recibido (net_pkt_read_u8) y se pasa sin modificar a la búsqueda. Un servidor DHCP, o cualquier host capaz de inyectar una respuesta DHCP falsificada en el enlace del cliente, puede, por lo tanto, llevar el índice fuera de los límites. La ranura fuera de rango produce un const char * basura que luego es desreferenciado por una conversión de registro %s.\n\nLa búsqueda se alcanza solo desde una instrucción de registro de depuración (NET_DBG / LOG_DBG), por lo que la lectura fuera de límites es activable solo cuando el módulo de registro DHCPv4 se compila en nivel DEBUG (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), lo cual no es la configuración predeterminada. Cuando se cumple esa condición, el resultado es una lectura fuera de límites y una desreferencia de puntero ’salvaje’: muy probablemente un fallo del cliente DHCP (denegación de servicio) y potencialmente la divulgación del contenido de un puntero adyacente a través de la salida del registro. La solución reemplaza sizeof con ARRAY_SIZE, restaurando la ventana de aceptación correcta de 1..8."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"subsys/net/lib/dhcpv4/dhcpv4.c",
"subsys/net/lib/dhcpv6/dhcpv6.c"
],
"versions": [
{
"version": "1.7.0",
"lessThan": "4.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-03T17:50:29.274490Z",
"id": "CVE-2026-10773",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
},
{
"lang": "en",
"value": "CWE-682"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6.0",
"versionEndExcluding": "4.5.0",
"matchCriteriaId": "DD732473-E0F3-4E27-AD8B-983D7D9C10D6"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r5hq-xq42-wcfq",
"source": "[email protected]",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r5hq-xq42-wcfq",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
}
]
}