{"id":"CVE-2025-70102","aliases":["DEBIAN-CVE-2025-70102","EUVD-2025-210156","GHSA-9g28-83m6-mvg3","SUSE-SU-2026:22542-1","SUSE-SU-2026:22561-1","UBUNTU-CVE-2025-70102","openSUSE-SU-2026:21220-1"],"status":"published","title":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing...","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00176,"percentile":0.07087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-06-15T00:00:00Z","modified":"2026-10-31T09:47:33Z","fixes":[{"ecosystem":"Debian:13","package":"dhcpcd","fixed_in":["1:10.1.0-11+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dhcpcd","fixed_in":["1:10.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dhcpcd5","fixed_in":["9.4.1-24~deb12u5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"dhcpcd","fixed_in":["10.3.2-160000.1.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dhcpcd","fixed_in":["10.3.2-160000.1.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dhcpcd","fixed_in":["10.3.2-160000.1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"dhcpcd","fixed_in":["10.3.2-160000.1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-11+deb13u3"}]}],"versions":["1:10.1.0-11","1:10.1.0-11+deb13u1","1:10.1.0-11+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.3.1-1"}]}],"versions":["1:10.1.0-11","1:10.1.0-12","1:10.2.0-1","1:10.2.2-1","1:10.2.2-2","1:10.2.2-3","1:10.2.2-4","1:10.2.2-5","1:10.2.2-6","1:10.2.3-1","1:10.2.4-1","1:10.2.4-2","1:10.2.4-3","1:10.2.4-4","1:10.2.4-4~bpo13+1","1:10.3.0-1","1:10.3.0-2","1:10.3.0-2~bpo13+1","1:10.3.0-3","1:10.3.0-3~bpo13+1","1:10.3.0-4","1:10.3.0-5","1:10.3.0-6","1:10.3.0-7","1:10.3.0-7~bpo13+1","1:10.3.1-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:12","package":"dhcpcd5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.1-24~deb12u5"}]}],"versions":["9.4.1-22","9.4.1-23","9.4.1-24~deb12u1","9.4.1-24~deb12u2","9.4.1-24~deb12u3","9.4.1-24~deb12u4"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.2-160000.1.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.2-160000.1.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.2-160000.1.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.2-3ubuntu3","1:10.0.5-1","1:10.0.5-2","1:10.0.5-3","1:10.0.5-4","1:10.0.5-5","1:10.0.6-1","1:10.0.6-1ubuntu1","1:10.0.6-1ubuntu2","1:10.0.6-1ubuntu3","1:10.0.6-1ubuntu3.1","1:10.0.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0-8","1:10.1.0-10","1:10.1.0-11","1:10.1.0-12","1:10.2.4-3","1:10.2.4-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.4-4","1:10.3.0-2","1:10.3.0-3","1:10.3.0-7"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.2-160000.1.2"}]}]}],"references":[{"url":"https://infosec.exchange/@sigdevel/116733594508542047","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70102"},{"url":"https://github.com/advisories/GHSA-9g28-83m6-mvg3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-70102","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622542-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268761","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70102","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622561-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-70102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-70102","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-70102","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-10-30T15:05:26.723Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-210156","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-10-30T15:05:26Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:06.268136Z"}],"ghsa":[{"id":"GHSA-9g28-83m6-mvg3","title":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing...","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T21:30:38Z","modified":"2026-10-30T18:32:15Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:14:51.443103Z"}],"nvd":[{"id":"CVE-2025-70102","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T20:16:24.827Z","modified":"2026-10-30T16:17:34.373Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"DEBIAN-CVE-2025-70102","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T20:16:24.827Z","modified":"2026-10-31T09:47:33.633020576Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-70102","description":"A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.","status":"published","published":"2026-06-15T20:16:00Z","modified":"2026-09-25T00:40:23.453011096Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"openSUSE-SU-2026:21220-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issue\n\nUpdate to 10.3.2:\n\n- CVE-2025-70102: NULL pointer dereference in `parse_option()` when processing a specially crafted configuration input\n  (bsc#1268761).\n\nChanges for dhcpcd:\n\n * options: Ensure ldop is not NULL dereferenced\n * DHCP: Don't run double EXPIRE hooks on carrier loss\n * DHCP: free the state when dropping on state NONE\n * BSD: don't send uninitialised memory using\n ps_root_indirectioctl\n * Fix fallback_time option\n * IPv4: Ignore DHCP state when building routes\n * route: Routes may not have an interface assinged\n * options: Ensure that an overly long bitflag string does not\n crash\n * options: Don't assume vsio options have an argument\n * common: Cast via uintptr_t rather than unsigned long in UNCONST\n * privsep: Ensure we recv for real after a successful recv\n MSG_PEEK\n * DHCP: Add parentheses to macro definitions\n * ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping\n * privsep: enforce message boundaries with MSG_EOR on our\n messages\n * Protocols will notify when dhcpcd can exit\n * DHCP: Don't request T1 and T2\n * DHCP: Don't request a lease time\n * DHCP6: Don't exit if using DHCP4 INFORM in non manager mode\n * ND: Route Information Option prefix is optional\n * ipv6: respect slaac hwaddr to really use the hwaddr\n * When stopping all interfaces at exit and releasing,\n remove persistance\n * NetBSD: Delete RTF_CONNECTED route when changing it\n * privsep: Drain the log when the root process is exiting\n * eloop: vastly reworked, kqueue and epoll support on by default\n","status":"published","published":"2026-07-06T20:10:17Z","modified":"2026-07-09T10:00:08.711608877Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22542-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issue\n\nUpdate to 10.3.2:\n\n- CVE-2025-70102: NULL pointer dereference in `parse_option()` when processing a specially crafted configuration input\n  (bsc#1268761).\n\nChanges for dhcpcd:\n\n * options: Ensure ldop is not NULL dereferenced\n * DHCP: Don't run double EXPIRE hooks on carrier loss\n * DHCP: free the state when dropping on state NONE\n * BSD: don't send uninitialised memory using\n ps_root_indirectioctl\n * Fix fallback_time option\n * IPv4: Ignore DHCP state when building routes\n * route: Routes may not have an interface assinged\n * options: Ensure that an overly long bitflag string does not\n crash\n * options: Don't assume vsio options have an argument\n * common: Cast via uintptr_t rather than unsigned long in UNCONST\n * privsep: Ensure we recv for real after a successful recv\n MSG_PEEK\n * DHCP: Add parentheses to macro definitions\n * ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping\n * privsep: enforce message boundaries with MSG_EOR on our\n messages\n * Protocols will notify when dhcpcd can exit\n * DHCP: Don't request T1 and T2\n * DHCP: Don't request a lease time\n * DHCP6: Don't exit if using DHCP4 INFORM in non manager mode\n * ND: Route Information Option prefix is optional\n * ipv6: respect slaac hwaddr to really use the hwaddr\n * When stopping all interfaces at exit and releasing,\n remove persistance\n * NetBSD: Delete RTF_CONNECTED route when changing it\n * privsep: Drain the log when the root process is exiting\n * eloop: vastly reworked, kqueue and epoll support on by default\n","status":"published","published":"2026-07-06T20:10:18Z","modified":"2026-07-14T18:24:37.35521554Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22561-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issue\n\nUpdate to 10.3.2:\n\n- CVE-2025-70102: NULL pointer dereference in `parse_option()` when processing a specially crafted configuration input\n  (bsc#1268761).\n\nChanges for dhcpcd:\n\n * options: Ensure ldop is not NULL dereferenced\n * DHCP: Don't run double EXPIRE hooks on carrier loss\n * DHCP: free the state when dropping on state NONE\n * BSD: don't send uninitialised memory using\n ps_root_indirectioctl\n * Fix fallback_time option\n * IPv4: Ignore DHCP state when building routes\n * route: Routes may not have an interface assinged\n * options: Ensure that an overly long bitflag string does not\n crash\n * options: Don't assume vsio options have an argument\n * common: Cast via uintptr_t rather than unsigned long in UNCONST\n * privsep: Ensure we recv for real after a successful recv\n MSG_PEEK\n * DHCP: Add parentheses to macro definitions\n * ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping\n * privsep: enforce message boundaries with MSG_EOR on our\n messages\n * Protocols will notify when dhcpcd can exit\n * DHCP: Don't request T1 and T2\n * DHCP: Don't request a lease time\n * DHCP6: Don't exit if using DHCP4 INFORM in non manager mode\n * ND: Route Information Option prefix is optional\n * ipv6: respect slaac hwaddr to really use the hwaddr\n * When stopping all interfaces at exit and releasing,\n remove persistance\n * NetBSD: Delete RTF_CONNECTED route when changing it\n * privsep: Drain the log when the root process is exiting\n * eloop: vastly reworked, kqueue and epoll support on by default\n","status":"published","published":"2026-07-06T20:10:18Z","modified":"2026-07-15T18:24:11.32261636Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}