netfilter H323 OOB

Vulnerability analysis

The vulnerability occurs in DecodeQ931() when processing H.323 Q.931 packets in the netfilter conntrack helper. The code reads a 16-bit length field from the packet and decrements it by 1 to skip the protocol discriminator byte. If the original length is 0, the decrement causes an integer underflow, wrapping to -1 (or a very large value when interpreted as size_t), which is then passed to DecodeH323_UserInformation() as the buffer size. This leads to an out-of-bounds read beyond the allocated packet buffer. Because the resulting length is effectively unbounded, the read will traverse kernel heap memory until it hits an unmapped page, triggering a kernel panic. A limited amount of slab memory may be leaked before the crash. The attack surface is network-facing because H.323 Q.931 traffic is processed over TCP by netfilter conntrack when packets traverse the system.