ipvs NatICMP OOB

Vulnerability analysis

When IPVS processes ICMP error packets containing an embedded IP header, the code reads the IP header length field directly from the packet buffer at multiple points without caching the validated value. The initial validation only checks the minimum length but not the upper bound, so a crafted ICMP packet with an inflated header-length value causes the code to compute an offset beyond the actual packet data and write port-number modifications to out-of-bounds kernel memory. The fix passes a pre-validated header structure through the call chain so the offset to the embedded transport header is computed once from validated data and reused, eliminating both the repeated unvalidated reads and the missing upper-bound check. Exploitation requires IPVS to be configured on the target system and a local attacker capable of sending crafted ICMP packets through the IPVS processing path.