CVE-2026-115449: Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

A flaw was found in libslirp's ICMP echo request handling. In the function icmpreceive() in src/ipicmp.c, after receiving an ICMP reply via recv(), the mbuf length (mlen) and IP header length (iplen) are not updated to reflect the actual number of bytes received. They retain the original echo request size.

When the SOCKDGRAM ICMP socket is unavailable (pinggrouprange restricted) and slirp falls back to a SOCKRAW socket, recv() can deliver ICMP error messages (such as Host Unreachable) instead of echo replies. These messages are shorter and contain an inner IP header with the host's real network address. The memmove path processes this data, and the stale mlen causes the inner IP header (including the host's real IP) to be included in the echo reply sent back to the guest. This breaks the NAT isolation that slirp user-mode networking provides.

The attack requires the guest to ping a nonexistent host on the hypervisor's local network while SOCKDGRAM ICMP is restricted (which forces the raw socket fallback). No authentication or special privileges are needed on the guest side.

The leaked information is the host's real IP address (4 bytes of network metadata), not arbitrary host heap memory as originally reported.

Upstream fix: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788 Upstream issue: https://gitlab.freedesktop.org/slirp/libslirp/-/workitems/105

Reported by: Piyusha Akash (manifoldoperations) via PSIRTSUPT-26209

— Red Hat