dhcpcd -- remote code execution/denial of service
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
in dhcpcd 5.x in Android before 5.1 and other products, does not
validate the relationship between length fields and the amount of
data, which allows remote DHCP servers to execute arbitrary code or
cause a denial of service (memory corruption) via a large length
value of an option in a DHCPACK message.
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright