| Título | MikroTik RouterOS <= 7.20.x long-term channel (tested: 6.40.5, 6.44, 7.20.8); v6 line affected Integer Overflow |
|---|
| Descrição | RouterOS ships the long-deprecated Linux ipt_SAME netfilter target (removed from mainline Linux in 2008) as the user-configurable NAT action "same". The kernel-side validation function same_check() accumulates the address-pool size without an overflow check:
ipnum += (ntohl(max_ip) - ntohl(min_ip) + 1); // full range = 2^32, wraps u32 to 0
iparray = kmalloc(sizeof(u32) * ipnum); // kmalloc(0) -> ZERO_SIZE_PTR
for (each address) iparray[index++] = value; // ~2^32 OOB writes -> fatal fault
A single NAT rule with to-addresses=x.x.x.x-x.x.x.x bricks the device: the request panics the kernel immediately, and because the rule is saved to configuration BEFORE the panic, every subsequent boot re-loads and re-panics (permanent reboot loop), recoverable only by netinstall or physical reset.
Verified on RouterOS 7.20.8 (long-term) CHR: a one-line REST request bricks the device; serial console shows the boot banner repeating 4 times in 25 seconds; flash log contains 10 panic dumps within 4 minutes; the oops points to ipt_SAME+0xa9 (the iparray[index++] store) with CR2=0x10 (kmalloc(0) ZERO_SIZE_PTR), faulting in process "net" during boot-time rule reload.
The vulnerable code is identical between the v6 (linux-3.3.5) and v7 (linux-5.6.3) GPL source disclosures. The vendor silently fixed it in stable 7.23.1 (June 2026) and long-term 7.21.5 (July 2026): disassembly of the shipped fixed ipt_SAME.ko (binary-identical md5 in both channels) shows three added guards — a carry-check on the accumulation, a guard for the exact 2^32 wrap, and a final ipnum==0 rejection — while the parser normalizes ranges to CIDR and removes comma multi-range syntax. |
|---|
| Fonte | ⚠️ https://github.com/MeetFireAgain/cve/mikrotik/routeros-ipt-same-integer-overflow-brick.md |
|---|
| Utilizador | CindyCity (UID 90928) |
|---|
| Submissão | 02/09/2026 10h30 (há 2 meses) |
|---|
| Moderação | 19/10/2026 09h06 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 422285 [MikroTik RouterOS até 6.40.5/6.44/7.20.8 ipt_SAME.ko same_check Excesso de tampão] |
|---|
| Pontos | 20 |
|---|