CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntracksip: fix Content-Length u32 truncation in siphelptcp()
siphelptcp() parses the SIP Content-Length header with simplestrtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINTMAX are silently truncated before computing the SIP message boundary.
For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser.
Fix this by changing clen to unsigned long to match the return type of simplestrtoul(), and reject Content-Length values that exceed the remaining TCP payload length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In netfilter nf_conntrack_sip's sip_help_tcp(), change clen from unsigned int to unsigned long to match simple_strtoul()'s return type, and reject Content-Length values that exceed the remaining TCP payload length.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's netfilter SIP connection-tracking helper for TCP SIP traffic are exposed. The truncation occurs on 64-bit systems, where an oversized SIP Content-Length value can exceed the range of the unsigned int variable used by the vulnerable code.
What does an attacker need to send to trigger the flawed parsing?
An attacker needs to deliver a TCP SIP message with a Content-Length value larger than UINT_MAX, such as 4294967328, and include trailing data in the TCP segment. The truncated length can cause that trailing data to be handled as a second SIP message and passed to the SDP parser.
What changes in the fix?
The fix stores Content-Length in an unsigned long rather than an unsigned int, avoiding truncation of the value returned by simple_strtoul(). It also rejects Content-Length values greater than the remaining TCP payload length.