CVE-2026-126957: ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c
An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute() and icmpv4updatetimestamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptroffset in uint8t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. netpktwrite() then reads past the 40-byte optdata stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIGNETIPV4HDROPTIONS, which CONFIGNETIPV4IGMP selects, are affected.
Event History
Frequently Asked Questions
Which Zephyr builds are exposed?
Devices built with CONFIG_NET_IPV4_HDR_OPTIONS are affected. CONFIG_NET_IPV4_IGMP selects this option, so builds that enable IGMP are also affected.
What must an attacker be able to do to exploit this?
An attacker only needs network access to send a crafted ICMP Echo Request carrying an IPv4 Record Route or Timestamp option. No authentication, prior privileges, or user interaction is required.
What information can be exposed and how reliable is exploitation?
The ICMP Echo Reply can return up to 213 bytes of stack memory beyond the intended 40-byte option buffer, potentially including stack and heap pointers. A single crafted packet triggers the leak without crashing the device, allowing repeated attempts.