CVE-2025-70102

Executive Summary

CVE-2025-70102 is a NULL pointer dereference vulnerability in the dhcpcd network configuration daemon, version 10.3.0. The flaw resides in the parse_option() function within src/if-options.c at line 1886. When the parser encounters an unexpected or invalid option token, a lookup for a struct dhcp_opt returns a NULL pointer. The code then performs a member access on this NULL pointer, leading to a crash (denial of service). The vulnerability was discovered via instrumented fuzzing, which reported a runtime error: "member access within null pointer of type struct dhcp_opt". The CVSS score is 0.0 due to incomplete data, but the actual impact is a local denial of service with low attack complexity and no privileges required. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the dhcpcd package, which is a core network component in many Linux distributions and embedded systems. The package is maintained by Roy Marples and is widely distributed through official repositories. The lack of a patch and the nature of the flaw (NULL pointer dereference) indicate a potential supply chain risk for systems relying on dhcpcd for network configuration. Users should monitor for updates from their distribution vendors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must be able to supply a crafted configuration file or trigger the parsing of invalid options locally.
• Attack Complexity (AC): Low (L) – No special conditions are required; a malformed option token is sufficient.
• Privileges Required (PR): None (N) – No authentication or elevated privileges are needed.
• User Interaction (UI): None (N) – The attack does not require user interaction beyond the normal operation of dhcpcd.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The service crashes, causing a denial of service.

Threat Level: Medium (Local DoS). While the CVSS base score is 0.0 due to missing vector data, the actual severity is a local denial of service. The vulnerability is not remotely exploitable but can be triggered by a local user or process that controls dhcpcd configuration.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the parse_option() function of dhcpcd. The function is responsible for parsing configuration options from a file or command line. When an unexpected or invalid option token is encountered, the code attempts to look up the corresponding struct dhcp_opt entry. If the lookup fails (returns NULL), the code does not check for NULL before accessing members of the structure. This results in a segmentation fault or abort.

Root Cause: In src/if-options.c:1886, the code performs a member access on a pointer that can be NULL. The specific line is likely something like:

opt->option = ...; // or similar member access

without a preceding NULL check.

Trigger: The vulnerability is triggered by providing a configuration file or command-line option that contains an invalid or unexpected token. For example, a malformed option like --invalid-option or a configuration file with a syntax error could cause the lookup to return NULL.

Impact: The immediate impact is a crash of the dhcpcd daemon, leading to a denial of service for network configuration services. In a worst-case scenario, this could prevent a system from obtaining an IP address or other network parameters.

Vulnerable vs. Patched Code

Vulnerable Code (10.3.0):

// src/if-options.c:1886 (approximate)
struct dhcp_opt *opt = lookup_option(opt, token);
// No NULL check
opt->option = token; // NULL pointer dereference

Patched Code (Hypothetical):

// src/if-options.c:1886 (patched)
struct dhcp_opt *opt = lookup_option(opt, token);
if (opt == NULL) {
    // Handle error: log, skip, or return
    log_warn("Invalid option token: %d", token);
    return;
}
opt->option = token;

The patch adds a NULL check before accessing the opt pointer. If the lookup fails, the function logs a warning and returns gracefully instead of crashing.

Exploitation & Lab Setup

Red Team

Exploitation Scenario: An attacker with local access to a system running dhcpcd 10.3.0 can craft a configuration file or command-line argument that triggers the NULL pointer dereference. For example:

# Create a malformed configuration file
echo "invalid_option" > /tmp/dhcpcd.conf
# Run dhcpcd with the malformed config
dhcpcd -c /tmp/dhcpcd.conf

This will cause dhcpcd to crash, denying network configuration services.

Proof of Concept (No public exploit available):

# Simple Python script to generate a malformed config
with open("/tmp/dhcpcd.conf", "w") as f:
    f.write("invalid_option\n")
print("Malformed config created. Run: dhcpcd -c /tmp/dhcpcd.conf")

Blue Team

Detection: Monitor for crashes of the dhcpcd process. Use system logs to detect segmentation faults or aborts. Example log entry:

kernel: dhcpcd[1234]: segfault at 0 ip 00007f... sp 00007f... error 4 in dhcpcd

Mitigation: Restrict local access to the system. Use file integrity monitoring to detect unauthorized changes to dhcpcd configuration files. Implement process monitoring to restart dhcpcd automatically if it crashes.

Indicators of Compromise (IOCs)

• Process Crash: dhcpcd process terminates unexpectedly with a segmentation fault.
• Log Entries: System logs showing "segfault" or "runtime error: member access within null pointer" related to dhcpcd.
• Configuration Files: Presence of malformed configuration files containing invalid option tokens.
• Core Dumps: Core dump files generated by dhcpcd crashes.

Detection Engineering

YARA Rule

rule CVE_2025_70102_dhcpcd_null_ptr {
    meta:
        description = "Detects dhcpcd binary with NULL pointer dereference vulnerability"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-70102"
    strings:
        $vuln_code = { 48 8b 40 ?? 48 85 c0 74 ?? 48 8b 40 ?? } // Example pattern for NULL check missing
    condition:
        $vuln_code and filesize < 2MB
}

Sigma Rule

title: CVE-2025-70102 - dhcpcd NULL Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects dhcpcd crashes due to NULL pointer dereference
author: Valters IT
date: 2025-04-17
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "segfault at 0 ip"
        - "runtime error: member access within null pointer"
        - "dhcpcd.*abort"
    condition: selection
falsepositives:
    - Other software crashes
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-70102 - dhcpcd NULL Pointer Dereference Attempt"; flow:to_server; content:"invalid_option"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Limit who can run dhcpcd or modify its configuration files.
2. Monitor Logs: Watch for dhcpcd crashes and investigate immediately.
3. Use Process Supervisor: Configure a process supervisor (e.g., systemd, supervisord) to automatically restart dhcpcd if it crashes.

Long-Term Fix:

1. Apply Patch: Once a patch is released by the dhcpcd maintainer, update to the patched version.
2. Upgrade: Upgrade to a version of dhcpcd that includes the NULL check fix.
3. Workaround: If patching is not possible, consider using an alternative DHCP client (e.g., dhclient) until a fix is available.

Vendor Contact: Monitor the dhcpcd GitHub repository or mailing list for updates.

Valters IT