Linux Kernel RPL Header Length Overflow Vulnerability in IPv6 Routing Header Decompression

A vulnerability in the Linux kernel's IPv6 routing protocol for low-power and lossy networks (RPL) has been identified. The issue arises in the function 'ipv6_rpl_srh_decompress()', where the header length is calculated based on the number of addresses. When this number exceeds 127, the calculation overflows, leading to a truncation that can cause the decompressed data to overlap with other memory regions. This overlap allows for corruption of the routing header in forwarded packets, potentially disrupting network communication.

Impact

Exploitation of this vulnerability can lead to memory corruption by overwriting the routing header of forwarded IPv6 packets, which could disrupt normal network operations.

Reproduction

The vulnerability can be reproduced by sending an IPv6 packet with a routing header that includes 127 segments. This can be done by creating a packet that uses the maximum number of addresses allowed in the RPL routing header, which is 127. The 'ipv6_rpl_srh_decompress()' function will then incorrectly calculate the header length, leading to an overflow and memory corruption.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.