Disabling ip6_hdrnestlimit sysctl (=0) removes only ext-header depth bound: no hard floor
Summary
Ext-header loop bounded by if(ip6_hdrnestlimit && ++nest>ip6_hdrnestlimit)(:693). Short-circuit means sysctl net.inet6.ip6.hdrnestlimit=0 (default 50) disables check entirely. No hard-coded floor. Operator setting 0 lets attacker drive arbitrarily deep ext-header chains bounded only by pkt size. Configurable CPU amplification. Default config safe. Fix: treat 0 as default-50 or enforce internal HARD_MAX independent of operator input.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0470 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Disabling ip6_hdrnestlimit sysctl (=0) removes only ext-header depth bound: no h | 409 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet6/ip6_input.c:693: disabling ip6_hdrnestlimit removes only ext-header depth bound (no hard floor)
Verified recommended fix
Source-confirmed at sys/netinet6/ip6_input.c:693: disabling ip6_hdrnestlimit removes only ext-header depth bound (no hard floor)
Verdict
Source-confirmed at sys/netinet6/ip6_input.c:693: disabling ip6_hdrnestlimit removes only ext-header depth bound (no hard floor)
No comments yet.