CVE-2026-56117

Name
CVE-2026-56117
Description
dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/NetworkConfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34
disclosure@vulncheck.com https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-via-control-socket-handling

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:* dhcpcd >= None <= 10.3.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
dhcpcd edge-main 10.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.2.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.1.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd edge-main 10.1.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.24-main 10.3.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.23-main 10.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.22-main 10.2.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.21-main 10.1.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.21-main 10.1.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.20-main 10.0.6-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.20-main 10.0.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
dhcpcd 3.19-main 10.0.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable