[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260429002305.68ba7d1b@stansted.bc.ca.umbrellix.net>
Date: Wed, 29 Apr 2026 00:23:05 +0000
From: Ellenor Bjornsdottir <ellenor/securesoftware@...rellix.net>
To: MOHAMED AZIZ RAHMOUNI <mohamedaziz.rahmouni@...at.ucar.tn>
Cc: oss-security@...ts.openwall.com
Subject: Re: [SECURITY] Out-of-Bounds Read in MPLS Extension
Parsing — traceroute 2.1.2
FYI:
As Alan Coopersmith just said, oss-security is a public mailing list.
You would need to have emailed only individual persons and private
mailing lists (like secalert@...hat.com and Mr Butskoy) related to the
development and distribution of the program in question for this to
have been coordinated disclosure. The public message to
oss-security@...ts.openwall.com would then need to be posted in July,
not this month.
Remember that for the next vulnerability you try to do coordinated
disclosure for.
On Tue, 28 Apr 2026 23:03:58 +0100
MOHAMED AZIZ RAHMOUNI <mohamedaziz.rahmouni@...at.ucar.tn> wrote:
> Hello,
>
> I am reporting a security vulnerability I discovered in traceroute
> 2.1.2 during manual code review and dynamic fuzzing.
>
> Summary:
> An out-of-bounds read exists in traceroute/traceroute.c. After
> recvmsg() returns, bufp is advanced past the IPv4 header (bufp +=
> hlen) but n is not decremented accordingly. The subsequent call:
>
> handle_extensions(pb, bufp + offs, n - offs, step);
>
> passes a len value that is hlen bytes (20 for IPv4, 40 for IPv6)
> larger than the actual data available from bufp + offs. This causes
> the MPLS extension parser to read past the received packet boundary
> into uninitialized stack memory within buf[1280].
>
> The vulnerability is remotely triggerable by any on-path network
> device that can send a crafted ICMP Time Exceeded response with MPLS
> extensions to a traceroute -e invocation. I have confirmed the issue
> with a working proof of concept.
>
> Proposed fix (single line addition after line 1427):
>
> bufp += hlen;
> n -= hlen; // add this line
>
> I have attached a full technical report including root cause analysis,
> proof of concept code, memory layout analysis, and impact assessment.
>
> Please confirm receipt of this report.
>
> Regards,
> Security researcher Zyyz
>
> Mohamed Aziz Rahmouni
--
Ellenor et al Bjornsdottir, sysadmin umbrellix.net.
This is my laptop, and as such I might be on the go; by the time you
get this message I could already be back on my bike.
Please consider the environment before you ask an AI to summarize this
email or write me a response.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
