GHSA-h5m5-hm6j-cgpf: Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handlera6co() the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function computes context->contextlen / 8 and then performs memset(context->prefix + contextlen, 0, sizeof(context->prefix) - contextlen), where context->prefix is a fixed 16-byte array.

With contextlen between 136 and 255 (and the option length field set to 3, which the pre-fix validation accepts), contextlen / 8 evaluates to 17..31, so the memset length 16 - contextlen/8 underflows the unsigned sizet argument to roughly SIZEMAX. This produces an unbounded out-of-bounds memset that zeroes kernel memory well past the 6lo context structure.

The defect is reachable from unauthenticated, link-local input: any host on the same link can send a crafted Router Advertisement with a 6CO option. The RA handler validates only the option length field before calling handlera6co(), so a single packet triggers the wild write. The code is compiled when CONFIGNET6LOCONTEXT is enabled.

The impact is a reliable remote (adjacent) denial of service via memory corruption, with collateral integrity loss as the memset zeroes contiguous memory before the system faults. Router Advertisements are link-scoped and not forwarded, so the attacker must be on the same link (AV:A). The fix rejects any contextlen greater than 128 before the length computation.