netfilter SIP NAT OOB

Vulnerability analysis

The root cause is that mangle_content_len() in nf_nat_sip.c declared a stack buffer of only sizeof("65536") = 6 bytes, but used sprintf() (which has no bounds checking) to write a content-length value that can be up to 10 digits (up to 4294967295 for a u32). When a SIP packet with a sufficiently large SDP content-length is processed through NAT, sprintf() writes beyond the 6-byte stack buffer, causing a stack out-of-bounds write as confirmed by the KASAN report. Additional sprintf() calls in sip_sprintf_addr() and sip_sprintf_addr_port() also lacked bounds checking. The fix replaces all sprintf() calls with scnprintf() (which respects buffer size limits) and increases the mangle_content_len() buffer to sizeof("4294967295") = 11 bytes to accommodate the maximum possible value. The attack surface is network-reachable: any system with the nf_nat_sip kernel module loaded (typically on SIP-aware NAT gateways/firewalls) that processes SIP INVITE packets with crafted SDP content is vulnerable. No privileges are required from the attacker's perspective — the vulnerability is triggered by inbound network traffic.