ipvs FtpHelper Overflow

Vulnerability analysis

The IPVS FTP helper parses FTP PASV/EPSV responses to extract the data-connection port and address by accumulating decimal digits into fixed-width integer types without any overflow check. A crafted response with over-long numeric fields causes the port or address octets to silently wrap, so the helper programs the data connection with a truncated, incorrect value — potentially opening a conntrack expectation for an unintended port or host. The fix widens the port accumulator to 32 bits and rejects any value above 65535, and rejects address octets above 255, mirroring the earlier fix applied to the netfilter conntrack FTP helper. The vulnerability is reachable from any FTP server whose traffic transits an IPVS load balancer with the FTP helper loaded; the attacker needs no privileges on the load balancer, only the ability to deliver a crafted FTP response through it.