CVE-2015-2922 in Android
Summary
by MITRE
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2022
The vulnerability described in CVE-2015-2922 represents a critical flaw in the Linux kernel's implementation of the IPv6 Neighbor Discovery protocol, specifically within the ndisc_router_discovery function located in net/ipv6/ndisc.c. This vulnerability enables remote attackers to manipulate the hop-limit setting of IPv6 packets through maliciously crafted Router Advertisement messages, potentially compromising network security and routing integrity. The issue affects Linux kernel versions prior to 3.19.6, making it a significant concern for systems running older kernel versions that have not received the necessary security patches.
The technical flaw stems from inadequate validation of the hop_limit field within Router Advertisement messages. When a router sends an RA message containing a small hop_limit value, the vulnerable kernel implementation fails to properly validate this parameter before applying it to the network configuration. This allows an attacker positioned on the network to send crafted RA messages that could reduce the hop-limit to values that are either too small for normal network operations or that could be exploited to bypass certain network security controls. The hop-limit field in IPv6 serves as a mechanism to prevent packets from circulating indefinitely in the network, with a default value of 64 typically used in most implementations. When an attacker can manipulate this value, they effectively gain control over how long packets can traverse the network, which can lead to various security implications including network disruption and potential bypass of security controls.
The operational impact of this vulnerability extends beyond simple network disruption to encompass potential security breaches and denial of service conditions. An attacker could reduce the hop-limit to values that are too low for legitimate network traffic to traverse, effectively creating a denial of service condition where legitimate packets are dropped before reaching their destination. Additionally, the ability to manipulate hop-limit settings can be leveraged to bypass network security controls that rely on proper hop-counting mechanisms, potentially allowing attackers to evade detection or reach internal network segments that should be protected by hop-limit based filtering. This vulnerability particularly affects network environments where IPv6 is enabled and where the kernel is not properly patched, making it a significant concern for enterprise networks and cloud environments that may be running vulnerable kernel versions.
This vulnerability maps directly to CWE-20, which describes "Improper Input Validation," and relates to the broader category of protocol implementation flaws in network security systems. The attack vector aligns with ATT&CK technique T1071.004, which covers "Application Layer Protocol: DNS," although in this case it operates at the network layer through the IPv6 Neighbor Discovery protocol. The vulnerability also intersects with ATT&CK technique T1499.004, which deals with "Endpoint Denial of Service," as the hop-limit manipulation can be used to create denial of service conditions. Organizations should prioritize patching their Linux kernel installations to version 3.19.6 or later, where this vulnerability has been addressed through proper input validation of the hop_limit field in Router Advertisement messages. Network segmentation and monitoring of Router Advertisement traffic can serve as temporary mitigations, but the most effective solution remains the timely application of the kernel security patch that corrects the validation logic in the ndisc_router_discovery function.