GHSA-rf32-h832-hg8r: Potential out-of-bounds read in _nx_icmpv6_validate_options()
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55094 |
Severity |
Medium |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
The _nx_icmpv6_validate_options() function is responsible for parsing and validating ICMPv6 options within a received ICMPv6 packet. It operates on a raw pointer to a buffer of NX_ICMPV6_OPTION structs and iterates over the options using the length provided.
However, at the start of the while loop, the function accesses option→nx_icmpv6_option_length without checking that the option pointer still points to a valid and complete NX_ICMPV6_OPTION structure. If the remaining buffer (length) is smaller than the size of an NX_ICMPV6_OPTION, this access could lead to an out-of-bounds read.
This may occur, for example, if a malformed ICMPv6 packet contains a trailing option structure that is only partially present—e.g., a single byte instead of the required minimum length. The code would then attempt to read fields from memory outside the packet bounds.
code:
D:\threadx\netxduo-master\common\src\nx_icmpv6_validate_options.c
UINT _nx_icmpv6_validate_options(NX_ICMPV6_OPTION *option, INT length, INT additional_check)
{
UINT option_len;
/* Parse all option headers from the ICMPv6 header. */
while (length > 0) <-- if option is very small, e.g., 1.
{
/* Verify that the option length is not zero. */
if (option -> nx_icmpv6_option_length == 0) <-- will read out of bound here
{
return(NX_NOT_SUCCESSFUL);
}
/* Also check for NO SOURCE LINK LAYER ADDRESS. */
if ((additional_check == NX_NO_SLLA) &&
(option -> nx_icmpv6_option_type == 1))
{
return(NX_NOT_SUCCESSFUL);
}
/* Get the next option. */
option_len = ((UINT)option -> nx_icmpv6_option_length) << 3;
length -= (INT)option_len;
/*lint -e{923} suppress cast between pointer and ULONG, since it is necessary */
option = (NX_ICMPV6_OPTION *)NX_UCHAR_POINTER_ADD(option, option_len);
}