CVE-2019-18902highCWE-416

CVE-2019-18902: high-severity vulnerability in SUSE Linux Enterprise Server 12

wicked: Use-after-free when receiving invalid DHCP6 client options

Published · Updated

Follow this CVE+ Monitor openSUSE Leap+ Monitor SUSE Linux Enterprise Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.4%
In short

A flaw in wicked (a network configuration tool) allows attackers to send specially crafted DHCP6 messages that cause the program to use memory that has already been freed, leading to crashes or potentially allowing attackers to run malicious code on affected systems.

Technical detail

Use-after-free vulnerability in wicked's DHCP6 client option handling (CWE-416). Remote attackers can exploit this by sending malformed DHCP6 packets to trigger memory access violations, resulting in denial of service or potential code execution on systems running vulnerable versions.

Summary generated and translated by AI from the official description.
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
openSUSE · FactoryopenSUSE · Leap 15.1SUSE · SUSE Linux Enterprise Server 12SUSE · SUSE Linux Enterprise Server 15
Related CVEs — SUSE Linux Enterprise Server 12

In the same product, most dangerous first.

CVE-2019-18903HIGHwicked: Use-after-free when receiving invalid DHCP6 IA_PD optionEPSS 2.4%CVE-2019-3689MEDIUMnfs-utils: root-owned files stored in insecure /var/lib/nfs directoryEPSS 1.5%CVE-2018-12476MEDIUMobs-service-extract_file's outfilename parameter allows to write files outside of package directoryEPSS 1.0%CVE-2019-18905MEDIUMDeprecated functionality in autoyast2 automatically imports gpg keys without checking themEPSS 0.7%CVE-2019-3698MEDIUMnagios cron job allows privilege escalation from user nagios to rootEPSS 0.7%CVE-2020-8015HIGHLocal privilege escalation in exim package from user mail to rootEPSS 0.5%