Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-05T23:17:01.923Z",
  "pubdate": "2026-11-05T23:17:01.923Z",
  "executiveSummary": "FastNetMon versions 1.2.9 and earlier are susceptible to an out-of-bounds (OOB) read vulnerability located within the IPv6 packet parsing logic. The flaw stems from insufficient validation of packet length when processing IPv6 Fragment headers.\nAn unauthenticated remote attacker can exploit this vulnerability by crafting a malicious sFlow v5 RAW_PACKET_HEADER record containing a truncated IPv6 Fragment header. When the application attempts to process this malformed packet, the parser performs an out-of-bounds read, accessing memory beyond the allocated buffer.\nWhile current analysis using AddressSanitizer (ASan) confirms the memory violation, the impact on production availability—specifically whether the process terminates—remains unconfirmed. However, such vulnerabilities typically pose risks of information disclosure or potential stability issues in high-performance network sensors. This vulnerability requires no prior authentication and can be triggered remotely via specially crafted network traffic.",
  "technicalDetails": "The vulnerability resides in the function parse_raw_packet_to_simple_packet_full() within src/simple_packet_parser_ng.cpp. This function is responsible for parsing raw network packet data, including encapsulated IPv6 headers. The core issue is an improper bounds check regarding the ipv6_extension_header_fragment_t structure.\nWhen the parser encounters a packet where the protocol number is identified as IpProtocolNumberIPV6_FRAG, it assumes the presence of the eight-byte IPv6 Fragment header. The logic proceeds to dereference the structure pointer for this header without verifying if the remaining bytes in the packet buffer are sufficient to accommodate the full eight-byte header. If an attacker submits an sFlow v5 RAW_PACKET_HEADER where the actual packet payload is truncated—specifically omitting the mandatory bytes of the Fragment header—the code performs a read operation outside the intended memory region of the packet buffer.\nThe attack flow follows a specific path: An attacker injects a malformed sFlow packet into the network infrastructure monitored by FastNetMon. The sFlow collector receives the packet and passes the RAW_PACKET_HEADER to the vulnerable parse_raw_packet_to_simple_packet_full() function. The parser identifies the IPv6 Fragment protocol header but fails to validate the remaining length of the input buffer against the size of the ipv6_extension_header_fragment_t struct. Upon dereferencing, the CPU accesses invalid memory addresses. While AddressSanitizer identifies this as an illegal OOB read, the impact in a production deployment may vary depending on the memory layout and surrounding heap allocations.\nThe absence of size validation before processing extension headers allows an unauthenticated remote attacker to perform an out-of-bounds memory read. Because this occurs within a high-performance parser designed for rapid packet inspection, the vulnerability exposes the system to potential memory leakage of adjacent packet data or sensitive heap memory. There is currently no available vendor patch for this issue; therefore, the implementation remains vulnerable to any remote actor capable of reaching the sensor with crafted traffic."
}