Executive brief
The Linux kernel's IPv6 packet processing contains a flaw in the ipv6_find_tlv() function that can read beyond allocated memory boundaries. An attacker sending specially crafted IPv6 packets with malformed extension headers could trigger this vulnerability, leading to kernel crashes, information disclosure, or potential code execution on affected systems.
Technical details
The vulnerability is an out-of-bounds memory read in the net/ipv6/exthdrs_core.c file's ipv6_find_tlv() function. The root cause is insufficient bounds checking: the function fetches the optlen field from a network packet without first verifying that at least 2 bytes remain available to parse. This allows an attacker to craft a malicious IPv6 packet with a truncated extension header, causing the code to read past allocated buffer boundaries. The vulnerability requires network reachability to the target system but does not require authentication. A fix is available in the Linux kernel stable series, adding a bounds check (if (len < 2)) before accessing the optlen field.
Affected products
- Linux Linux kernel multiple versions prior to patch (affected from c61a40432509 onwards until fix applied)
Timeline
- 2023-05-30: disclosed: Patch commit 878ecb0897f4737a4c9401f3523fd49589025671 merged upstream
- 2023-05-30: patched: Fix applied to stable kernel branches