CVE-2014-2309 in Linux
Summary
by MITRE
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2014-2309 represents a critical memory management flaw within the Linux kernel's IPv6 routing subsystem. This issue affects kernel versions through 3.13.6 and stems from improper handling of route counting mechanisms in the ip6_route_add function. The vulnerability operates at the network protocol level where the kernel processes incoming ICMPv6 Router Advertisement packets, which are standard components of IPv6 network communication used for router discovery and configuration. The flaw specifically manifests when the kernel fails to properly account for route additions, creating a condition where malicious actors can exploit this oversight to consume excessive system memory resources.
The technical implementation of this vulnerability involves the kernel's routing table management system where each ICMPv6 Router Advertisement packet triggers the addition of new routing entries without proper validation of existing route counts. When an attacker floods a target system with these packets, the kernel's route counting mechanism becomes overwhelmed, leading to continuous memory allocation without corresponding deallocation. This creates a memory leak scenario that gradually consumes available system memory, ultimately resulting in system instability and potential denial of service conditions. The vulnerability is particularly dangerous because it operates at the kernel level where memory management is critical for overall system operation.
From an operational perspective, this vulnerability enables remote attackers to perform denial of service attacks with relatively minimal resources. The attack vector requires only the ability to send ICMPv6 Router Advertisement packets to the target system, which can be accomplished from any network location where the attacker has network connectivity. The memory consumption occurs gradually but continuously, making the attack difficult to detect and mitigate in real-time. Systems running affected kernel versions become increasingly unstable over time, potentially leading to complete system crashes or unresponsiveness. This vulnerability affects any Linux system that processes IPv6 traffic, making it particularly concerning for network infrastructure devices, servers, and any system with IPv6 enabled.
The impact of this vulnerability aligns with CWE-129, which addresses improper validation of array indices, and more specifically relates to memory management flaws in kernel space operations. According to ATT&CK framework, this vulnerability maps to T1499.004 which covers network denial of service attacks, and T1071.004 which involves application layer protocol usage. The flaw represents a classic example of a resource exhaustion attack where the attacker leverages legitimate network protocols to consume system resources. Mitigation strategies include applying kernel updates to versions that contain the patched ip6_route_add function, implementing network-level rate limiting for ICMPv6 Router Advertisement packets, and configuring firewall rules to restrict such traffic from untrusted networks. Additionally, system administrators should monitor memory usage patterns and implement automated alerting for unusual memory consumption spikes that could indicate exploitation attempts. The vulnerability highlights the importance of proper resource accounting in kernel space operations and demonstrates how seemingly benign protocol handling can create significant security risks when memory management is insufficiently validated.