Description
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | dhcp | Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 | — |
| Fedora | dhcp | Fedora 28 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | dhcp +4 | 12:4.2.5-68.el7_5.1 | RHSA-2018:1453 |
| RHEL 7 | imgbased +1 | 1.0.16-0.1.el7ev | RHSA-2018:1524 |
| RHEL 7 | ovirt-node-ng +1 | 4.2.0-0.20170814.0.el7 | RHSA-2018:1524 |
| RHEL 7 | redhat-release-virtualization-host +1 | 4.2-3.0.el7 | RHSA-2018:1524 |
| RHEL 7 | redhat-virtualization-host +1 | 4.2-20180508.0.el7_5 | RHSA-2018:1524 |
| RHEL 7 | rhvm-appliance | 2:4.2-20180504.0.el7 | RHSA-2018:1525 |
| RHEL 6 | dhcp +3 | 12:4.1.1-53.P1.el6_9.4 | RHSA-2018:1454 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.4 EUS | dhcp +4 | 12:4.2.5-58.el7_4.4 | RHSA-2018:1455 |
| RHEL 7.3 EUS | dhcp +4 | 12:4.2.5-47.el7_3.1 | RHSA-2018:1456 |
| RHEL 7.2 TUS | dhcp +4 | 12:4.2.5-42.el7_2.1 | RHSA-2018:1457 |
| RHEL 7.2 E4S | dhcp +4 | 12:4.2.5-42.el7_2.1 | RHSA-2018:1457 |
| RHEL 7.2 AUS | dhcp +4 | 12:4.2.5-42.el7_2.1 | RHSA-2018:1457 |
| RHEL 6.7 EUS | dhcp +3 | 12:4.1.1-49.P1.el6_7.1 | RHSA-2018:1458 |
| RHEL 6.6 TUS | dhcp +3 | 12:4.1.1-43.P1.el6_6.2 | RHSA-2018:1459 |
| RHEL 6.6 AUS | dhcp +3 | 12:4.1.1-43.P1.el6_6.2 | RHSA-2018:1459 |
| RHEL 6.5 AUS | dhcp +3 | 12:4.1.1-38.P1.el6_5.1 | RHSA-2018:1460 |
| RHEL 6.4 AUS | dhcp +3 | 12:4.1.1-34.P1.el6_4.2 | RHSA-2018:1461 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | dhcp +4 | 12:4.2.5-68.amzn2.1.2 | ALAS2-2018-1021 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dhcp +4 | 12:4.2.5-68.0.1.el7_5.1 | ELSA-2018-1453 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
DHCP Client Command Injection (DynoRoot)
exploit/unix/dhcp/rhel_dhcp_client_command_injection
Exploit-DB 2
- DHCP Client - Command Injection 'DynoRoot' (Metasploit) EDB-44890 · remote · Jun 13, 2018 · verified
- DynoRoot DHCP Client - Command Injection EDB-44652 · local · May 18, 2018 · verified
GitHub 3 repositories
-
knqyf263/CVE-2018-1111 ★ 13 · May 17, 2018
Environment for DynoRoot (CVE-2018-1111)
-
kkirsche/CVE-2018-1111 ★ 12 · May 18, 2018
CVE-2018-1111 DynoRoot
-
baldassarreFe/FEP3370-advanced-ethical-hacking ★ 0 · Nov 17, 2020
DHCP exploitation with DynoRoot (CVE-2018-1111)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 13
- RHSA-2018:1525 Red Hat Security Advisory: rhvm-appliance security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1524 Red Hat Security Advisory: redhat-virtualization-host bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1460 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1461 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1458 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1459 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1457 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1455 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1456 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1453 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1454 Red Hat Security Advisory: dhcp security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- ALAS2-2018-1021 Critical: dhcp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 29, 2018
- ELSA-2018-1453 Critical: dhcp security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 15, 2018
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1111
- https://www.tenable.com/security/tns-2018-10
- FEDORA-2018-5392896132 vendor-advisory
- https://access.redhat.com/security/vulnerabilities/3442151
- 104195 vdb-entry
- FEDORA-2018-23ca7a6798 vendor-advisory
- 1040912 vdb-entry
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- RHSA-2018:1454 vendor-advisory
- RHSA-2018:1455 vendor-advisory
- RHSA-2018:1457 vendor-advisory
- RHSA-2018:1459 vendor-advisory
- RHSA-2018:1453 vendor-advisory
- FEDORA-2018-36058ed9f2 vendor-advisory
- RHSA-2018:1524 vendor-advisory
- RHSA-2018:1456 vendor-advisory
- RHSA-2018:1461 vendor-advisory
- 44652 exploit
- 44890 exploit
- RHSA-2018:1458 vendor-advisory
- RHSA-2018:1460 vendor-advisory