REDHAT-BUG-2558916: Low severity libslirp libslirp vulnerability
A flaw was found in libslirp's ICMP echo request handling. In the function icmpreceive() in src/ipicmp.c, after receiving an ICMP reply via recv(), the mbuf length (mlen) and IP header length (iplen) are not updated to reflect the actual number of bytes received. They retain the original echo request size.
When the SOCKDGRAM ICMP socket is unavailable (pinggrouprange restricted) and slirp falls back to a SOCKRAW socket, recv() can deliver ICMP error messages (such as Host Unreachable) instead of echo replies. These messages are shorter and contain an inner IP header with the host's real network address. The memmove path processes this data, and the stale mlen causes the inner IP header (including the host's real IP) to be included in the echo reply sent back to the guest. This breaks the NAT isolation that slirp user-mode networking provides.
The attack requires the guest to ping a nonexistent host on the hypervisor's local network while SOCKDGRAM ICMP is restricted (which forces the raw socket fallback). No authentication or special privileges are needed on the guest side.
The leaked information is the host's real IP address (4 bytes of network metadata), not arbitrary host heap memory as originally reported.
Upstream fix: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788 Upstream issue: https://gitlab.freedesktop.org/slirp/libslirp/-/workitems/105
Reported by: Piyusha Akash (manifoldoperations) via PSIRTSUPT-26209
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 262c9be27bc79e16b369807b460be77e23c3d788
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Exposure requires libslirp to fall back from a SOCK_DGRAM ICMP socket to a SOCK_RAW socket because ping_group_range restricts the datagram socket. The guest must also be able to send a ping to a nonexistent host on the hypervisor's local network.
What access does an attacker need to trigger the information leak?
No authentication or special privileges are required on the guest side. An attacker needs the ability to cause the guest to ping a nonexistent host on the hypervisor's local network while the raw-socket fallback is active.
What information can be disclosed?
The issue can disclose the host's real IP address from an inner IP header in an ICMP error message. The disclosed data is limited to four bytes of network metadata and is not arbitrary host memory.