Bug 2488997 (CVE-2025-70102)

Summary: CVE-2025-70102 dhcpcd: dhcpcd: Denial of Service via NULL pointer dereference during configuration option parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: mosvald, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in dhcpcd. A specially crafted configuration input may cause the parse_option() function to dereference a NULL pointer while processing malformed option data. This issue may result in application termination and a denial of service condition.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2491328, 2491329    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-15 20:02:17 UTC 
A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.
Comment 2 Martin Osvald 🛹 2026-06-24 05:16:03 UTC 
The fixing commit is https://github.com/NetworkConfiguration/dhcpcd/commit/f2a7340afdc15f6bc4fb269972e21445daf245f6