What is CVE-2014-7912?

CVE-2014-7912 is a vulnerability in Dhcpcd Project, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2015-07-30.

Is CVE-2014-7912 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Dhcpcd Project

CVE-2014-7912

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

Vulnerability class: Buffer Overflow

EPSS: 0.027 (84.8th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

vaginessa/cve-2014-7912

References

chrome-cve-admin@google.com (vdb-entry, x_refsource_SECTRACK)
chrome-cve-admin@google.com (x_refsource_MISC)
chrome-cve-admin@google.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2014-7912?: CVE-2014-7912 is a vulnerability in Dhcpcd Project, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2015-07-30.
Is CVE-2014-7912 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.