search menu icon-carat-right cmu-wordmark

CERT Coordination Center

OpenBSD IPv6 kernel buffer overflow vulnerability

Vulnerability Note VU#986425

Original Release Date: 2007-03-15 | Last Revised: 2007-05-03


A vulnerability in the OpenBSD kernel could allow a remote attacker to execute arbitrary code on a vulnerable system or cause the system to crash.


The OpenBSD kernel contains a flaw in its handling of kernel memory buffers when processing IPv6 packets. This flaw results in a memory corruption vulnerability that allows a remote attacker with the ability to send fragmented ICMPv6 packets to trigger an overflow of mbuf kernel memory structures. The original reporters of this vulnerability, Core Security Technologies, have published a detailed analysis of this vulnerability in CoreLabs Advisory CORE-2007-0219.

Systems connected to public IPv6 networks are particularly at risk from this vulnerability. However, since link-local addresses are part of the IPv6 specification and configured by default on Ethernet interfaces, even systems that have not been explicitly configured to use public IPv6 networks are vulnerable to attack from other systems on the same physical network or multicast network.

Note that we are aware of working, publicly available exploit code for this vulnerability.


A remote, unauthenticated attacker with the ability to supply a specially crafted fragmented IPv6 packet may be able to execute arbitrary code on a vulnerable system or cause the system to crash. The attacker-supplied code would be executed in the context of the kernel.


Apply a patch from the vendor

The OpenBSD development team has published patches to address this issue. Please see the System Affected section of this document for more information.

Note that a second revision of the patch was released after the initial publication of this document. Users should be sure to obtain this second revision of the patch.

Filter IPv6 packets

Sites, particularly those who are unable to apply the patch, are encouraged to filter IPv6 traffic to affected hosts. For the OpenBSD packet filter, pf(4), use "block in inet6" in /etc/pf.conf.

Vendor Information


OpenBSD Affected

Updated:  March 21, 2007



Vendor Statement

A second revision of the patch fixing incorrect mbuf handling for ICMP6
packets has been created.

It will be available via ftp soon from the URLs given below.
The fix has also been applied to the OpenBSD 3.9 and 4.0 stable branches
in cvs, please see for details.

Please make sure you get the second revision of the patch, as noted in
the patch files.

OpenBSD 3.9: errata 020

OpenBSD 4.0: errata 010

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group Score Vector



This vulnerability was discovered and researched by Alfredo Ortega from Core Security Technologies.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: CVE-2007-1365
Severity Metric: 16.80
Date Public: 2007-03-12
Date First Published: 2007-03-15
Date Last Updated: 2007-05-03 19:51 UTC
Document Revision: 18

Sponsored by CISA.