CVE-2025-70102: dhcpcd 10.3.0 NULL Pointer Dereference Denial of Service

Technical summary

A NULL pointer dereference vulnerability exists in the parse_option() function at src/if-options.c:1886 in dhcpcd 10.3.0. During configuration option parsing, a lookup operation on an option token can return NULL under certain conditions—such as receipt of an unexpected or invalid option token, or an invalid parsing state. The vulnerable code proceeds to dereference this NULL pointer as a 'struct dhcp_opt' without null-checking, triggering a crash. Fuzzing instrumentation confirms the vulnerability manifests as 'runtime error: member access within null pointer of type struct dhcp_opt'.

Business impact

The primary impact is denial of service: affected systems running dhcpcd will crash when exposed to specially crafted or malformed configuration options, temporarily disrupting DHCP-dependent network functionality. In environments where dhcpcd is critical to network boot, container initialization, or automatic IP configuration, such crashes can disrupt service availability. While not a remote code execution risk, the crash can be leveraged for disruption attacks or as a vector for follow-on attacks when combined with system restart delays.

Affected systems

Roy Marples NetworkConfiguration dhcpcd version 10.3.0 is confirmed vulnerable. Systems running dhcpcd for DHCP configuration—including Linux systems, embedded devices, virtualization hosts, and containers relying on dynamic IP assignment—are affected if they process untrusted configuration input or accept configuration from potentially malicious sources.

Exploitability

The vulnerability requires delivery of a crafted configuration option string to the affected parse_option() function. Exploitability depends on the attack surface: if dhcpcd processes configuration files or options from untrusted sources (local unprivileged users, network-accessible config services, or adversary-supplied DHCP messages with embedded options), the barrier to triggering the crash is low. The attack does not require special privileges or user interaction, though it does require access to configuration input mechanisms. Remote exploitation is possible if the system accepts malicious DHCP option payloads.

Remediation

Upgrade dhcpcd to a version that includes a null-pointer check before dereferencing the option structure returned by the lookup operation. Verify the patched version against Roy Marples' official releases and security advisories. As an interim mitigation, restrict configuration input sources and disable DHCP option parsing features if not required for your deployment.

Patch guidance

Check Roy Marples' official dhcpcd repository and security advisories for version 10.3.1 or later, which should include a fix for this NULL pointer dereference. Verify the patch against the vendor advisory to confirm the specific version number. Test patched versions in a non-production environment before deploying broadly, particularly on systems where DHCP is critical to network initialization.

Detection guidance

Monitor system logs for dhcpcd process crashes or unexpected terminations, particularly in correlation with configuration reloads or DHCP message events. If running instrumented or debug builds, watch for runtime errors mentioning 'member access within null pointer of type struct dhcp_opt'. Check for suspicious or malformed DHCP option payloads in network traffic or configuration file changes. Correlate crash timestamps with any configuration pushes or untrusted DHCP server activity.

Why prioritize this

Although scored as MEDIUM severity (CVSS 6.3), this vulnerability should be prioritized for systems where dhcpcd is critical to service availability or where untrusted configuration input is a realistic threat. Denial-of-service vulnerabilities in foundational network services can cascade to affect dependent applications and infrastructure. Systems in environments accepting configuration from partially-trusted sources (multi-tenant hosts, edge devices, or those processing remote config updates) warrant faster remediation.

Risk score, explained

CVSS 3.1 score of 6.3 reflects a vulnerability with local or adjacent network attack vector (AV:A), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). The impact is bounded—confidentiality, integrity, and availability are each lowered but not fully compromised. This is a denial-of-service issue rather than a data breach or privilege escalation, hence the MEDIUM rating rather than HIGH.

Frequently asked questions