CVE-2019-18902: 
Linux openSUSE vulnerability analysis and mitigation

A Use After Free vulnerability (CVE-2019-18902) was discovered in the wicked component of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, openSUSE Leap 15.1, and Factory. The vulnerability was disclosed in March 2020 and affects multiple versions of the wicked package across different SUSE distributions (NIST NVD, SUSE Bugzilla).

The vulnerability occurs when processing invalid DHCP6 client options. Specifically, when ni_dhcp6_fsm_parse_client_options() processes a packet with an invalid DHCP6 client option, it frees msg->lease without clearing it to NULL, leading to a Use After Free condition. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (CRITICAL) (NIST NVD).

The vulnerability allows remote attackers to cause a Denial of Service (DoS) condition or potentially execute arbitrary code on affected systems (NIST NVD).

Fixed versions have been released for affected systems. Users should upgrade to the following versions: SUSE Linux Enterprise Server 12 wicked version 0.6.60-3.5.1 or later, SUSE Linux Enterprise Server 15 wicked version 0.6.60-3.21.1 or later, openSUSE Leap 15.1 wicked version 0.6.60-lp151.2.6.1 or later, and openSUSE Factory wicked version 0.6.62 or later (NIST NVD).