{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dragonfly-bsd-all-releases-including-6.4.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:dragonflybsd:dragonfly_bsd:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-110912"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DragonFly BSD (all releases including 6.4.2)"],"_cs_severities":["high"],"_cs_tags":["kernel-vulnerability","memory-disclosure","arp","dragonfly-bsd"],"_cs_type":"advisory","_cs_vendors":["DragonFly BSD Project"],"content_html":"\u003cp\u003eCVE-2026-110912 is an unauthenticated remote kernel heap and stack memory disclosure vulnerability in DragonFly BSD. The vulnerability exists within the ARP implementation in \u003ccode\u003esys/netinet/if_ether.c\u003c/code\u003e, specifically in the \u003ccode\u003earpintr()\u003c/code\u003e and \u003ccode\u003ein_arpreply()\u003c/code\u003e functions. The kernel fails to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets.\u003c/p\u003e\n\u003cp\u003eAn attacker on the same local L2 segment can craft an ARP request specifying larger-than-expected length fields. When \u003ccode\u003ein_arpreply()\u003c/code\u003e processes these packets, it uses the attacker-controlled values as lengths for \u003ccode\u003ememcpy()\u003c/code\u003e, causing the kernel to copy data from adjacent heap or stack memory into the ARP reply. This allows an attacker to leak sensitive kernel memory, including KASLR-defeating pointers and return addresses. The vulnerability has been present since the initial 2003 code import and remains unpatched in all tagged releases as of October 2026, despite a fix existing in the master branch.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target host on the same L2 network segment.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a custom ARP REQUEST packet using a tool like Scapy.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the ARP header fields \u003ccode\u003ear_hln\u003c/code\u003e (hardware address length) or \u003ccode\u003ear_pln\u003c/code\u003e (protocol address length) to values exceeding the legitimate 6 (MAC) and 4 (IPv4) bytes respectively.\u003c/li\u003e\n\u003cli\u003eAttacker transmits the malformed ARP REQUEST to the victim host.\u003c/li\u003e\n\u003cli\u003eThe victim's kernel (\u003ccode\u003earpintr()\u003c/code\u003e) fails to validate the address length fields and proceeds to \u003ccode\u003ein_arpreply()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ein_arpreply()\u003c/code\u003e function performs an out-of-bounds \u003ccode\u003ememcpy()\u003c/code\u003e of kernel memory based on the attacker's requested lengths.\u003c/li\u003e\n\u003cli\u003eThe leaked kernel memory is encapsulated into an ARP REPLY packet and transmitted back to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker receives the packet and parses the OOB data to extract kernel pointers, facilitating the bypass of KASLR.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the disclosure of sensitive kernel memory. An attacker can recover kernel \u003ccode\u003e.text\u003c/code\u003e return addresses and KVA pointers, effectively defeating Kernel Address Space Layout Randomization (KASLR). This information leakage serves as a critical prerequisite for chaining further exploits to achieve arbitrary code execution or privilege escalation. Every release of DragonFly BSD is affected, and the attack is undetectable to the host system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMonitor local network segments for ARP packets with non-standard \u003ccode\u003ear_hln\u003c/code\u003e or \u003ccode\u003ear_pln\u003c/code\u003e values using network-based intrusion detection systems.\u003c/li\u003e\n\u003cli\u003eApply the upstream patch from commit \u003ccode\u003e4bb22ffcf2e9fb44995fbfd9945194afc87fb182\u003c/code\u003e to all custom builds, as no official tagged release currently includes the fix.\u003c/li\u003e\n\u003cli\u003eImplement strict ARP packet filtering or validation at the L2 switch level where possible to reject packets with invalid hardware or protocol address lengths.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-15T08:57:37Z","date_published":"2026-10-15T08:57:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dragonfly-bsd-arp-memory-leak/","summary":"CVE-2026-110912 allows an unauthenticated attacker on a local L2 network to disclose kernel heap and stack memory by sending malformed ARP requests with oversized length fields.","title":"Kernel Memory Disclosure in DragonFly BSD via ARP","url":"https://feed.craftedsignal.io/briefs/2026-10-dragonfly-bsd-arp-memory-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - DragonFly BSD (All Releases Including 6.4.2)","version":"https://jsonfeed.org/version/1.1"}