Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2023 20:19:42 +0200
From: Erik Auerswald <>
Subject: Re: IPv6 and Route of Death

Hi all,

On Wed, May 17, 2023 at 07:13:51PM +0200, Solar Designer wrote:
> On Wed, May 17, 2023 at 10:02:31AM -0400, Jeffrey Walton wrote:
> > This seems to have been dropped as a 0-day. I have not seen a CVE
> > assigned to it.
> The "original writeup" you reference says this is CVE-2023-2156.
> > I _think_ this is the original writeup:
> > 
> >   *

It also mentions that "the bug patch didn't solve the underlying problem
(ZDI confirmed this too), so we're still expecting another patch at
some[ ]point."

The Zero Day Initiative (ZDI) entry[0] linked from the article[1]
gives a time line:

01/26/22 – ZDI reported the vulnerability to the vendor.
04/14/23 – The vendor informed the ZDI that a new patch would merge
           into the latest mainline on 04/21/2023.
04/21/23 – The original finder reports to the vendor that the patch
           may not work, and it was confirmed by the ZDI that the
           vulnerability is reproducible on the latest mainline.
05/02/23 – The ZDI informed the vendor that the case will be published
           as a zero-day advisory on 05/04/23, and in coordination with
           Red Hat this vulnerability will be assigned CVE-2023-2156.


The problem described pertains to handling of IPv6 "RPL Source Routing"
using an IPv6 "Extension Header" of the "Routing Header" variant,
the "RPL Source Route Header" (SRH, Routing Type 3).  This header
is described in RFC 6554.  The RFC specifies that RPL border routers
"do not allow datagrams already carrying an SRH header to enter or exit
a[n] RPL routing domain."

The informational RFC 9288 recommends that "IPv6 packets with IPv6
Extension Headers (or options) that are not expected to traverse transit
routers should be dropped."  This is provided as general advice, not
specific to RPL.

Of course, filtering at the border does not protect against compromised
RPL nodes.

Only systems with enabled RPL functionality seem to be vulnerable (as
far as I understand the report).

The described bug pertains to processing the SRH header at the penultimate

The described result of exploiting the vulnerability is a kernel panic,
i.e., a remote DoS.

A distributed system is one in which the failure of a computer you didn't
even know existed can render your own computer unusable.
                        -- Leslie Lamport

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.