Description
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low
Affected products
- Nmap / Nmap0 – 7.99
References
- MISChttps://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc
- PATCHhttps://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83
- MISChttps://nmap.org/changelog.html
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing