CVE-2020-17469: AMNESIA:33

[senier]

Description

The IPv6 packet reassembly function does not check whether the received fragments are properly aligned in memory, allowing attackers to perform memory corruption with crafted IPv6 fragmented packets.

Root cause

An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment starting from a network incoming fragment that still doesn't have a reference to the previous one (which supposedly resides in the reassembly list). When faced with an incoming fragment that belongs to a non-empty fragment list, IPv6 reassembly must check that there are no empty holes between the fragments: this leads to an uninitialized pointer dereference in _fnet_ip6_reassembly in fnet_ip6.c, and causes Denial-of-Service.

Software

Name

FNET

Versions affected

≤ 4.6.4

Links

• CVE Entry
• Report