Description

net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable = base/2 and max_reachable = 3*base/2 using integer division. When base_reachable_time is 1, both min_reachable and the modulus collapse so the function returns 0, and net_if_ipv6_set_reachable_time() stores that 0 into ipv6->reachable_time. The base_reachable_time is attacker-controlled: handle_ra_input() in subsys/net/ip/ipv6_nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAX_REACHABLE_TIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link. When a neighbor is subsequently confirmed reachable, net_ipv6_nbr_set_reachable_timer() reads the value and executes NET_ASSERT(time, "Zero reachable timeout!"). On builds with CONFIG_ASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with K_MSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T19:17:14.627Z",
  "pubdate": "2026-09-14T19:17:14.627Z",
  "executiveSummary": "A remote Denial of Service (DoS) vulnerability exists in the Zephyr RTOS IPv6 stack due to improper handling of the Reachable Time field within Router Advertisement (RA) packets.\nThe vulnerability allows an unauthenticated attacker on the same link to manipulate the system's neighbor reachable timer, leading to kernel assertions or perpetual Neighbor Discovery failure.\nThe root cause is an integer division operation that results in a zero-value reachable timer when an attacker provides a specific, small input.\nImpact includes system instability (when assertions are enabled) or complete degradation of IPv6 neighbor communication, resulting in a loss of network availability.\nNo authentication or specific privileges are required to exploit this issue; the attacker only needs to be adjacent to the target link to transmit a malicious RA packet.",
  "technicalDetails": "The vulnerability originates in net_if_ipv6_calc_reachable_time() located in subsys/net/ip/net_if.c. The function computes a randomized neighbor reachable time based on a base_reachable_time value, defining the range as [min_reachable, max_reachable] where min_reachable equals base/2 and max_reachable equals 3*base/2.\nWhen base_reachable_time is set to 1, the integer division logic results in both min_reachable and max_reachable evaluating to 0. Consequently, the modulus operation collapses, causing the function to return a value of 0. This zero-value is subsequently persisted into the ipv6->reachable_time field via net_if_ipv6_set_reachable_time().\nThe attack vector involves the handle_ra_input() function in subsys/net/ip/ipv6_nbr.c, which processes incoming Router Advertisements. The code accepts any non-zero Reachable Time field value provided the value is less than or equal to MAX_REACHABLE_TIME. By injecting a link-local RA with a Reachable Time field set to 1, an attacker forces the stack to adopt this malicious configuration.\nThe impact manifests during the neighbor discovery process when net_ipv6_nbr_set_reachable_timer() is invoked. The function attempts to arm a timer based on the stored reachable time value. If the build configuration includes CONFIG_ASSERT, the explicit NET_ASSERT(time, ...) check detects the zero-value condition and triggers a kernel panic, resulting in an immediate device reset.\nIn builds where assertions are disabled, the kernel attempts to arm the timer with K_MSEC(0). This causes the timer to fire immediately and continuously. The resulting behavior forces the networking stack into an infinite loop of re-solicitation, where neighbor entries are incorrectly flagged as STALE. This effectively prevents the device from maintaining functional IPv6 connectivity with its neighbors, inducing a persistent DoS state without crashing the kernel.\nThe exploit is highly accessible as it does not require authentication or elevated privileges, relying only on the attacker's ability to transmit unauthenticated RA packets on the local link. The vulnerability is limited to network availability and does not permit memory corruption, arbitrary code execution, or data exfiltration."
}