CVE-2026-115863 in ConnMan
Summary
by MITRE • 10/23/2026
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in ConnMan versions through 2.0 represents a critical stack-based buffer overflow within the DHCPv6 client implementation, specifically located in the get_domains function found in gdhcp/client.c. This flaw arises from an improper handling of input data received via DHCPv6 Reply messages, where the application fails to validate the length of incoming options against the size of the destination buffer before performing memory copy operations. The core technical deficiency involves copying up to NS_MAXDNAME bytes, which equals 1025 bytes, from a DHCPv6 DOMAIN_LIST option into a stack-allocated dns_name buffer that is only 1026 bytes in size. While this specific copy operation might appear marginally safe due to the small difference between source and destination sizes, the subsequent processing logic introduces severe instability by walking through DNS labels using an unbounded loop structure defined as c += jump + 1. This iterative process does not adequately check boundary conditions relative to the actual length of the option data provided in the network packet, allowing for out-of-bounds memory access when crafted input is supplied.
An attacker positioned on the same local network segment can exploit this vulnerability without requiring any form of authentication or prior credentials. The attack vector relies on sending a forged Router Advertisement with the Other-Configuration flag set to one, followed immediately by a malicious DHCPv6 REPLY message that matches the expected transaction ID and client identifier of the target ConnMan instance. By constructing a DOMAIN_LIST option containing at least 1025 non-zero bytes, the attacker forces the unbounded label-walking loop to traverse beyond the allocated stack buffer boundaries. This results in reading or writing memory past the end of the dns_name variable, potentially overwriting adjacent stack data such as return addresses, saved frame pointers, or other critical control flow information. The ability to write arbitrary values into these areas significantly increases the likelihood of achieving remote code execution if combined with additional exploitation techniques, although the immediate and guaranteed impact is a denial of service condition resulting in the crash of the connmand process.
The operational impact of this vulnerability is severe due to the privilege level at which ConnMan typically operates. Since connman runs as root on most Linux distributions, compromising or crashing this daemon can disrupt network connectivity for the entire system and potentially allow an attacker to escalate privileges further if memory corruption leads to code execution. The crash occurs because the out-of-bounds access corrupts stack integrity, leading to a segmentation fault when the function attempts to return or accesses invalid pointers derived from corrupted data structures. This denial of service affects all network services managed by ConnMan on the affected host, rendering it unable to maintain IPv6 connectivity until the daemon is restarted manually or automatically depending on system configuration. The vulnerability was introduced in commit bb06c47 and persists through version 2.0, highlighting a regression in input validation practices during recent development cycles.
From a classification perspective, this flaw aligns with CWE-121, which denotes stack-based buffer overflow, as well as CWE-20 regarding improper input validation where the application fails to verify that received data conforms to expected constraints before processing. In terms of attack behavior, it maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically under sub-technique T1498.003 which involves flooding or overwhelming resources via crafted network packets. Mitigation strategies should prioritize updating ConnMan to a version that includes the fix for this specific issue, ensuring that input validation checks are implemented within the get_domains function to strictly enforce length limits based on the actual DHCPv6 option size rather than fixed constants. Additionally, deploying network intrusion detection systems capable of identifying anomalous DHCPv6 traffic patterns can provide an additional layer of defense against exploitation attempts from malicious actors on local networks. System administrators should also consider restricting DHCPv6 message processing to trusted interfaces where possible and monitoring for unexpected crashes or restarts of the connman service as indicators of potential compromise activity.