CVE-2011-3605 in router advertisement daemon
Summary
by MITRE
The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/15/2022
The vulnerability identified as CVE-2011-3605 affects the router advertisement daemon radvd version 1.8.1 and earlier, presenting a significant denial of service risk when the UnicastOnly configuration option is enabled. This flaw resides within the process_rs function, which handles Neighbor Discovery Router Solicitation messages in the IPv6 network infrastructure. The vulnerability specifically targets the daemon's response handling mechanism when processing a high volume of solicitation requests, creating a condition where legitimate service operations become disrupted through resource exhaustion or processing delays.
The technical exploitation of this vulnerability involves remote attackers sending an excessive number of ND_ROUTER_SOLICIT messages to a system running radvd with UnicastOnly enabled. This configuration mode typically restricts router advertisements to unicast responses only, but the flaw in the process_rs function fails to properly manage or rate-limit these incoming requests. The implementation does not adequately validate or throttle the rate of solicitation messages, allowing a malicious actor to overwhelm the daemon's processing capabilities and cause temporary service hang conditions that effectively deny service to legitimate network users.
From an operational impact perspective, this vulnerability compromises the availability of IPv6 network services by causing temporary service hangs in router advertisement functionality. The daemon's inability to properly handle high-volume solicitation requests results in degraded network performance and potential disruption of IPv6 addressing and routing services. Network administrators may experience intermittent connectivity issues as the daemon becomes unresponsive to legitimate routing advertisement requests, affecting the overall stability of IPv6 network infrastructure. The vulnerability particularly impacts environments where radvd is deployed as a critical network service component in IPv6 configurations.
The flaw aligns with CWE-400, which categorizes resource exhaustion vulnerabilities, and represents a classic denial of service scenario where system resources become consumed through excessive request processing. From an ATT&CK framework perspective, this vulnerability maps to technique T1499.004, specifically targeting network denial of service through resource exhaustion. The vulnerability also demonstrates characteristics of T1595.001 related to reconnaissance and T1589.002 related to resource hijacking. Organizations should implement immediate mitigation strategies including updating to radvd version 1.8.2 or later, configuring rate limiting for router solicitation messages, and monitoring for unusual traffic patterns in IPv6 network segments. Additionally, network segmentation and access control measures can help limit the attack surface and prevent unauthorized exploitation of this vulnerability.