Page MenuHomeVyOS Platform
Create Task
Maniphest T8473

Accel-PPP remote DoS - Case: Multiple Rapid-commit options in DHCPv6 SOLICIT msg
Closed, ResolvedPublic
Actions

Description

With an active session established, crafted DHCPv6 Solicit with many Rapid-Commit options exhausts fixed reply buffer causing NULL dereference.

Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: connect: ppp0 <--> pppoe(0c:a2:45:a5:00:00)
Mar 29 10:58:14 vyos accel-pppoe[4884]: ppp0:vyos2: vyos2: authentication succeeded
Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Main process exited, code=exited, status=255/EXCEPTION
Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Failed with result 'exit-code'.
Mar 29 10:58:29 vyos systemd[1]: accel-ppp@pppoe.service: Scheduled restart job, restart counter is at 1.
Mar 29 10:58:29 vyos systemd[1]: Stopped Accel-PPP - High performance VPN server application for Linux.
Mar 29 10:58:29 vyos systemd[1]: Starting Accel-PPP - High performance VPN server application for Linux...
Mar 29 10:58:29 vyos systemd[1]: Started Accel-PPP - High performance VPN server application for Linux.

Vyos Config:

set service pppoe-server authentication local-users username vyos password 'vyos'
set service pppoe-server authentication mode 'local'
set service pppoe-server client-ip-pool POOL range '10.0.0.2-10.0.0.254'
set service pppoe-server client-ipv6-pool POOL6 prefix 2001:db8:1::/64 mask '64'
set service pppoe-server default-ipv6-pool 'POOL6'
set service pppoe-server default-pool 'POOL'
set service pppoe-server gateway-address '10.0.0.1'
set service pppoe-server interface eth1
set service pppoe-server ppp-options ipv6 'allow'

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Security vulnerability

Event Timeline

RC created this task.Apr 10 2026, 2:36 AM
RC changed the task status from Open to In progress.
RC triaged this task as High priority.
RC created this object in space S1 VyOS Public.
RC created this object with visibility "Administrators".
RC updated the task description. (Show Details)Apr 10 2026, 2:38 AM
Viacheslav changed the visibility from "Administrators" to "Public (No Login Required)".Mon, Oct 5, 9:00 AM
pasik subscribed.Mon, Oct 5, 9:06 AM
Viacheslav closed this task as Resolved.Mon, Oct 5, 9:10 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.