Description

Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T17:16:39.130Z",
  "pubdate": "2026-08-17T17:16:39.130Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code, specifically within the get_ihpc_inlined_size() function located in subsys/net/ip/6lo.c. The flaw arises from missing bounds-checking on index values derived from received packet bits used to query da_inline_size_table.\nThe primary impact of this vulnerability is a denial-of-service condition affecting the receiver through an out-of-bounds read and subsequent memory corruption during header reconstruction.\nAffected systems include Zephyr RTOS installations processing inbound 6LoWPAN frames via the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c).\nAn unauthenticated attacker positioned on the radio or adjacent link can exploit this vulnerability with no privileges or user interaction required, simply by transmitting a specially crafted 6LoWPAN frame containing an invalid destination addressing-mode nibble.",
  "technicalDetails": "The vulnerability resides in the get_ihpc_inlined_size() function within subsys/net/ip/6lo.c of Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression implementation.\nThe root cause of the flaw is the absence of bounds validation for table lookups using indices generated from the received IPHC dispatch word. Specifically, the destination inline size is retrieved from da_inline_size_table, which contains exactly 13 entries. The index is constructed using a 4-bit value (0-15) derived from the M, DAC, and DAM bits of the incoming frame (iphc & NET_6LO_IPHC_DA_MASK).\nBecause the reserved combinations 13, 14, and 15 are not validated against the table boundaries, an attacker can supply a crafted frame where the destination addressing-mode nibble selects an out-of-range index. This results in an out-of-bounds read past the end of da_inline_size_table.\nThe attack flow begins when an unauthenticated attacker on the radio or adjacent link transmits a crafted 6LoWPAN frame. Every inbound 6LoWPAN frame triggers get_ihpc_inlined_size() via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c).\nUpon processing the malformed frame, the out-of-bounds value returned from the unvalidated lookup is treated as the computed inline_size. This value directly drives subsequent header reconstruction logic prior to any buffer-length verification. It is utilized to dereference memory pointers via *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t difference value that is susceptible to integer underflow.\nThis underflow triggers a secondary out-of-bounds read of the packet buffer, causing malformed uncompression and leading to a radio-triggerable denial-of-service condition on the receiving device. While memory is read out-of-bounds, the leaked byte data is not returned to the attacker across the network channel."
}