Page MenuHomeVyOS Platform
Create Task
Maniphest T8475

Accel-PPP remote DoS - Case: crafted DHCPv6 Relay-forward packet with multiple (>HOP_COUNT_LIMIT) nested relay layers
Closed, ResolvedPublic
Actions

Description

A subscriber with an active IPoE (or PPPoE) session sends a crafted DHCPv6 Relay-forward packet with > HOP_COUNT_LIMIT nested relay layers and causes a crash.

Mar 30 17:49:54 vyos accel-ipoe[15776]: ipoe0:: recv [DHCPv6 Solicit XID=434241 <Client-ID 3:000102000000000141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141> <Elapsed-Time 50331648> <IA-NA 11111111 T1=0 T2=0> <IA-PD 22222222 T1=0 T2=0> <Option 0>]
Mar 30 17:49:54 vyos systemd[1]: accel-ppp@ipoe.service: Main process exited, code=killed, status=6/ABRT
Mar 30 17:49:54 vyos systemd[1]: accel-ppp@ipoe.service: Failed with result 'signal'.
Mar 30 17:49:54 vyos systemd[1]: accel-ppp@ipoe.service: Scheduled restart job, restart counter is at 6.
Mar 30 17:49:54 vyos systemd[1]: Stopped Accel-PPP - High performance VPN server application for Linux.
Mar 30 17:49:54 vyos systemd[1]: Starting Accel-PPP - High performance VPN server application for Linux...
Mar 30 17:49:54 vyos systemd[1]: Started Accel-PPP - High performance VPN server application for Linux.

Vyos Config:

set service ipoe-server authentication mode 'noauth'
set service ipoe-server client-ip-pool default range '192.0.2.10-192.0.2.200'
set service ipoe-server client-ipv6-pool POOL prefix 2001:db8:1::/64 mask '64'
set service ipoe-server default-ipv6-pool 'POOL'
set service ipoe-server default-pool 'default'
set service ipoe-server gateway-address '192.0.2.1/32'
set service ipoe-server interface eth1 client-subnet '192.0.2.0/24'
set service ipoe-server interface eth1 mode 'l2'
set service ipoe-server interface eth1 network 'shared'

Attacker
set interfaces ethernet eth0 address 'dhcp'

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Security vulnerability

Event Timeline

RC created this task.Apr 10 2026, 2:51 AM
RC changed the task status from Open to In progress.
RC triaged this task as High priority.
RC created this object in space S1 VyOS Public.
RC created this object with visibility "Administrators".
Viacheslav changed the visibility from "Administrators" to "Public (No Login Required)".Mon, Oct 5, 8:59 AM
pasik subscribed.Mon, Oct 5, 9:06 AM
Viacheslav closed this task as Resolved.Mon, Oct 5, 9:10 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.