Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte. The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer(). irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read. Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T08:16:44.187Z",
  "pubdate": "2026-08-28T08:16:44.187Z",
  "executiveSummary": "The Linux kernel's netfilter subsystem contains an off-by-one out-of-bounds (OOB) read vulnerability within the parse_dcc() function of the nf_conntrack_irc module.\nThe vulnerability arises due to a discrepancy between the function's pointer boundary logic and its caller's memory addressing convention, leading to a read beyond the intended buffer limits.\nAn attacker can exploit this flaw by sending crafted IRC DCC (Direct Client-to-Client) messages that trigger the parser to process uninitialized or stale memory contents adjacent to the packet buffer.\nSuccessful exploitation may result in the manipulation of conntrack expectations, potentially leading to incorrect DCC IP or port assignments.\nThis vulnerability poses a risk to systems utilizing netfilter for IRC traffic inspection, as it allows for the subversion of connection tracking logic, which could be leveraged to bypass security policies or disrupt legitimate communications.\nNo authentication or elevated privileges are required for an attacker to reach the vulnerable code path via crafted network traffic.",
  "technicalDetails": "The root cause of this vulnerability is an incorrect boundary condition in the parse_dcc() function within the nf_conntrack_irc kernel module. The function expects an inclusive end pointer, but it receives an exclusive end pointer (data_limit = ib_ptr + datalen) from its caller.\nWithin parse_dcc(), the newline search loop is defined as 'while (tmp <= data_end)'. Because 'data_end' is passed as the exclusive end of the buffer, the pointer 'tmp' reaches one byte beyond the valid memory region when no newline character is found. This triggers a read operation on memory that resides outside the region filled by the skb_header_pointer() function.\nAlthough the irc_buffer is allocated with an additional byte (MAX_SEARCH_SIZE + 1) and the data length is capped at MAX_SEARCH_SIZE, the current implementation relies on this extra byte as a fragile guard. The stray read consumes uninitialized or stale data from the kernel heap. If this extraneous byte happens to contain an ASCII digit, the simple_strtoul() function will include this data in the conversion process.\nThis behavior impacts the parsing of DCC IP addresses and ports. By influencing the state of the kernel's conntrack expectation mechanism, an attacker can cause the kernel to register malicious or incorrect session expectations. This subversion of the conntrack state machine can lead to unauthorized hole-punching in firewall rules or the redirection of legitimate traffic to attacker-controlled destinations.\nThe attack flow requires the attacker to transmit a malformed IRC DCC request that lacks a terminating newline character within the expected range. The kernel, attempting to parse the DCC parameters, performs an OOB read on the adjacent memory. If the memory contains bytes interpreted as ASCII digits, the parsed conntrack state is corrupted.\nThis vulnerability is particularly concerning as it highlights a lack of consistency between buffer size definitions and loop termination conditions in the netfilter subsystem, creating a recurring class of boundary-related defects."
}