barebox Out-of-Bounds Read Vulnerability in DHCP Option Parsing

A out-of-bounds read vulnerability has been identified in barebox versions prior to 2026.04.0. The issue arises in the DHCP option parsing within the dhcp_message_type() function, where the parser fails to properly validate the options pointer against the bounds of the received packet. This vulnerability allows an attacker on the same broadcast domain to send a crafted DHCP Offer or ACK packet that lacks a proper 0xff end marker. As a result, the parser can read beyond the valid packet data, potentially leading to a system crash.

Impact

Exploitation of this vulnerability can cause a system crash, due to the out-of-bounds read that disrupts normal operation.

Remediation

Users can upgrade to barebox version 2026.04.0 to address this vulnerability.