CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 は、XNU カーネルの ICMP エラーコードにおけるバッファオーバーフローの脆弱性です。この脆弱性により、IOS デバイス（ラップトップとモバイルの両方）は、1 つ（そうです、たった 1 つ！）の不正なパケットを受信するだけでクラッシュします。 このバグは、Kevin Backhouse 氏によって 2018 年 10 月 30 日に彼の lgtm ブログ記事 で最初に公開されました。 このリポジトリのコードは、scapy と nmap を使用して Python で実装された CVE-2018-4407 エクスプロイトの概念実証で...

AppleDOS

AppleDOS CVE-2018-4407 CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407、このtweet、およびこのvideoに基づいています。このバグは、OSが不正なパケットのセグメントを含むICMPメッセージを送信者に返送しようとする際の不正なパケット処理におけるヒープオーバーフローの脆弱性です。...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tunnels: Fixed the crash when generating IPV4 PMTU errors due to KASAN. If we attempt to emit an ICMP error in response to a non-linear SKB, we encounter the following issue: Bug: KASAN: Out-of-bounds access in...

Astra Linux – Vulnerability in OVN

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header’s self-declared total length iptotlen for IPv4, ip6plen for IPv6, without validating it against the actual packet buffer siz...

CVE-2026-74597

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 tunnel error handling. A remote attacker could send a specially crafted IPv6 ICMP Internet Control Message Protocol error packet with a malformed inner destination-options header. This could lead to memory corruption within t...

CVE-2026-74669

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

CVE-2026-72319

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. This vulnerability occurs when the system processes Internet Control Message Protocol ICMP errors originating from network tunnels. Specifically, after stripping outer packet headers, the IPVS component fails to ensure that...

Linux Distros Unpatched Vulnerability : CVE-2026-72319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP...

SUSE-SU-2026:23188-1 Security update for openvswitch

This update for openvswitch fixes the following issues: - CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499...

CVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

UBUNTU-CVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

PT-2026-72507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvs component where inner IP headers in ICMP errors from tunnels may not be correctly placed in the skb headroom after outer headers are stripped using the pskb...

SUSE-SU-2026:22991-1 Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

SUSE-SU-2026:22988-1 Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. ...

SUSE-SU-2026:22971-1 Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.184 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

SUSE SLES15 Security Update : kernel RT (Live Patch 14 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3246-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3246-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.51 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15: libopenvswitch-2_14-0 / libovn-20_06-0 / openvswitch / etc (SUSE-SU-2026:2481-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2481-1 advisory. This update for openvswitch fixes the following issues - CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498...

kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash denial of...