A vulnerability has been identified in the background process slaacd, which is responsible for IPv6 address autoconfiguration in OpenBSD (IPv6 Stateless Address Autoconfiguration, RFC 4862), leading to a buffer overflow when receiving a specially crafted IPv6 Router Advertisement (RA).
Initially, the functionality of IPv6 address autoconfiguration was implemented at the kernel level, but starting from OpenBSD 6.2, it was moved to a separate unprivileged process, slaacd. This process is responsible for sending Router Solicitation (RS) messages and parsing the responses from Router Advertisement (RA) with information about the router and network connection parameters.
In February, a bug causing a crash in slaacd when specifying 7 servers in the RDNSS (Recursive DNS Servers) list was fixed. This oversight attracted the attention of independent researchers who tried to examine the code of slaacd for other errors occurring during the parsing of fields in RA messages. The analysis revealed another issue in the code, manifesting during the processing of the DNSSL (DNS Search List) field, which includes lists domain names and host patterns for DNS.
Each name in the DNSSL list is encoded using a null-terminated separator and intermediate single-byte labels that define the size of the subsequent data. The vulnerability is caused by the fact that in the parsing code, the size field is copied into a signed integer variable ("len = data[pos]"). Accordingly, when a value with its most significant bit set is specified in the field, this value will be interpreted in the conditional operator as a negative number, and the check for the maximum allowed size ("if (len > 63 || len + pos + 1 > datalen) {") will not trigger, leading to a memcpy call with a parameter where the size of the copied data exceeds the buffer size.
Source: opennet.ru
