Nmap IPv6 Extension Header Parsing Length Wraparound Vulnerability Analysis

Vulnerability Overview This vulnerability involves a length wraparound condition in Nmap's IPv6 extension header parser. Specifically, when processing an extension header that partially exists within the captured packet, the parser checks if two extension header bytes are available and uses the second byte as the extension header length. If the declared length exceeds the remaining payload length, the parser stores the remaining payload length in an unsigned integer and calculates the offset for the payload pointer. This can cause the payload pointer to exceed the capture length, resulting in a wraparound value. Scope Core parser behavior: Validation adjustment path: Relevant downstream consumers: - - - Remediation The research status for this vulnerability is currently "in progress," and no specific remediation has been provided. POC Code The following is the POC code used to demonstrate the vulnerability: Build and Run Linux, macOS, WSL, or MinGW Windows PowerShell and MinGW Expected Output Mechanism The helper path traverses the IPv6 extension header with the following logic: The missing invariant is a backward length check before calculating the remaining length. If the declared extension length moves beyond the end of the packet, the remaining length calculation will wrap around within the . Subsequently, the original scan and packet validation consumers may treat the packet as still having a valid upper-layer payload. Research Notes This entry focuses on IPv6 extension header length wraparound because it is the strongest fresh parser candidate from the latest Nmap review cycle. Other reviews surfaced from the same research push are captured in , including raw scan short transport header reads, Nping EchoClient NEP partial packet handling, Ncat HTTP parser issues, and NSE negative length behavior. Exploitability research is ongoing to determine if this parser primitive can be shaped into stronger memory primitives, going beyond parser state corruption, out-of-bounds reads, and fatal allocation behaviors. Responsible Use Run the PoC only in a local research environment. The included PoC is a standalone arithmetic and parser behavior test designed for researching parser transformations.

Goal Reached Thanks to every supporter — we hit 100%!

Nmap IPv6 Extension Header Parsing Length Wraparound Vulnerability Analysis

More from this source