Junglewise Threat Intelligence

CVE-2016-10142: IPv6 Protocol ICMPv6 Packet Too Big fragmentation denial of service

CVE-2016-10142 · Severity: high · CVSS 8.6 · Published 2017-01-14

Technologies: Red Hat Enterprise Linux, F5 BIG-IP. Vendors: Red Hat, F5.

Executive brief

A fundamental flaw in the IPv6 protocol specification allows remote attackers to disrupt network communications across a wide variety of devices and operating systems. By sending specially crafted network control messages, an attacker can trick a target system into breaking its data traffic into small fragments that are often blocked by security filters. This results in a denial-of-service condition where the target system effectively blocks its own legitimate traffic, potentially cutting off critical services or administrative access.

Technical details

The vulnerability exists in the handling of ICMPv6 Packet Too Big (PTB) error messages as defined in the IPv6 protocol specification (RFC 2460). An attacker can send a forged ICMPv6 PTB message reporting an MTU smaller than 1280 bytes, which forces the victim to generate 'atomic fragments' for all subsequent packets in that flow. If intermediate security devices (like firewalls or ACLs) are configured to drop IPv6 fragments to prevent other attacks, the victim's legitimate traffic will be dropped by the network infrastructure. This flaw affects all compliant IPv6 implementations and can be used to bypass security controls or cause a permanent DoS state for BGP peering sessions or standard host communications. Mitigation involves implementing RFC 6946 or RFC 8021 to deprecate the generation of atomic fragments.

Affected products

  • Generic (All Vendors) IPv6 Protocol Implementation
  • Red Hat Enterprise Linux 6
  • F5 BIG-IP
  • Pulse Secure Pulse Connect Secure

Timeline

  • 2016-10-14: other: CVE Reserved date
  • 2017-01-14: disclosed: Initial NVD publication
  • 2017-03-21: patched: Red Hat released kernel updates for RHEL 6

References

Related threats