CVE-2006-4572 in Linux
Summary
by MITRE
ip6_tables in netfilter in the Linux kernel before 2.6.16.31 allows remote attackers to (1) bypass a rule that disallows a protocol, via a packet with the protocol header not located immediately after the fragment header, aka "ip6_tables protocol bypass bug;" and (2) bypass a rule that looks for a certain extension header, via a packet with an extension header outside the first fragment, aka "ip6_tables extension header bypass bug."
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability described in CVE-2006-4572 represents a critical flaw in the IPv6 packet filtering implementation within the Linux kernel's netfilter framework. This issue affects versions prior to 2.6.16.31 and specifically targets the ip6_tables module responsible for handling IPv6 packet filtering rules. The vulnerability stems from improper validation of IPv6 packet structures during rule evaluation, creating exploitable gaps in the firewalling mechanism that could allow malicious actors to circumvent security policies.
The technical flaw manifests in two distinct but related bypass scenarios that exploit the kernel's handling of fragmented IPv6 packets. In the first scenario, an attacker can bypass protocol restriction rules by crafting packets where the protocol header does not immediately follow the fragment header, effectively confusing the packet parsing logic. This occurs because the kernel's rule evaluation does not properly account for the possibility that protocol headers may appear at non-standard positions within fragmented packets. The second bypass involves extension header rules that can be circumvented when extension headers are placed outside the first fragment of a packet, exploiting the same parsing inconsistency in the ip6_tables module.
These vulnerabilities create significant operational impacts for systems relying on IPv6 filtering for security. The protocol bypass bug allows attackers to potentially send traffic that should be blocked by firewall rules, while the extension header bypass enables circumvention of more sophisticated filtering policies. Both scenarios can be exploited remotely without requiring local access or authentication, making them particularly dangerous in network environments where IPv6 filtering is used to control traffic flow and enforce security boundaries. The implications extend beyond simple traffic bypass to potentially enable more sophisticated attacks that rely on specific protocol or header combinations.
The vulnerability aligns with CWE-119, which addresses improper access to memory locations, and relates to ATT&CK technique T1071.004 for application layer protocol manipulation. Organizations affected by this vulnerability face increased risk of unauthorized network access and data exfiltration attempts. The bypass mechanisms exploit fundamental flaws in packet validation logic, undermining the integrity of IPv6 filtering policies. Systems implementing IPv6 firewalls, network security appliances, and any infrastructure relying on kernel-based packet filtering are at risk. The exploitation requires minimal privileges and can be automated, making it particularly attractive to threat actors seeking to establish persistent network access or conduct reconnaissance activities.
Mitigation strategies should prioritize immediate kernel updates to versions 2.6.16.31 or later where the vulnerability has been patched. Network administrators should also consider implementing additional monitoring for anomalous packet patterns that might indicate exploitation attempts. The patch addresses the core parsing logic issues by ensuring proper validation of IPv6 packet structures regardless of fragment ordering or header placement. Organizations should conduct thorough vulnerability assessments to identify systems running affected kernel versions and implement network segmentation to limit the potential impact of successful exploitation attempts. Regular security updates and patch management processes should be strengthened to prevent similar vulnerabilities from remaining unaddressed in production environments.