DirtyAH6

DirtyAH6 CVE-2026-80844 分析文章 !WARNING 本 PoC 仅用于帮助防御者、维护人员以及获得授权的安全团队，在他们拥有或 明确获授权测试的系统上验证补丁、缓解措施、检测规则和暴露面。 您需自行确保对本材料的使用是合法、获授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会修改 /etc/pam.d/su，且没有任何回滚机制。 一次位置错误的覆写可能破坏无关的内核内存，导致机器挂起或崩溃。 请仅在一次性虚拟机/可丢弃主机上运行。 该 PoC： 1. 进入私有的用户/网络命名空间，构建 veth、IOAM6、netem、AH...

EUVD-2026-71294

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...

PT-2026-61301

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the ipv6 rpl srh decompress function when processing Routing Header SRH decompression. The hdrlen variable, defined as u8, fails to hold values when n is 12...

CVE-2026-43501

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve maclen headroom when recompressed SRH grows ipv6rplsrhrcv decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6hdr-daddr, recompresses, then pulls the old header and pushes the new on...

CVE-2026-31674

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the ip6trt module. This vulnerability occurs when processing IPv6 routing header RT match rules with an oversized address number addrnr. A local attacker could exploit this by crafting a malicious netfilter rule,...

EUVD-2017-4504

Malware in sbrugna...

SUSE CVE-2007-1388

The doipv6setsockopt function in net/ipv6/ipv6sockglue.c in Linux kernel before 2.6.20, and possibly other versions, allows local users to cause a denial of service oops by calling setsockopt with the IPV6RTHDR option name and possibly a zero option length or invalid option value, which triggers ...

SUSE CVE-2017-12986

The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6print...

EulerOS 2.0 SP1 : tcpdump (EulerOS-SA-2017-1280)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvpobjprint.CVE-2017-13048 - The ARP parser in tcpdump before...

openSUSE Security Update : tcpdump (openSUSE-2017-1205)

This update for tcpdump to version 4.9.2 fixes several issues. These security issues were fixed : - CVE-2017-11108: Prevent remote attackers to cause DoS heap-based buffer over-read and application crash via crafted packet data. The crash occured in the EXTRACT16BITS function, called from the...

CVE-2017-13725: Out-of-bounds Read

The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6print...

CVE-2017-12986: Out-of-bounds Read

The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6print...

Tcpdump IPv6 routing header parser buffer overflow vulnerability

Tcpdump is a set of sniffing tools developed by the Tcpdump team that run under the command line. The tool allows users to intercept and display TCP/IP and other packets sent or received over a network connection to that computer.IPv6 routing header parser is one of the IPv6 routing header parser...