地图 / CVE-2017-12986 The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().

CVE-2017-12986 The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().

内存破坏 / 缓冲区越界读 / #268804

厂商: Internet Bug Bounty
严重程度: 中危 · CVSS 7.3
赏金: —
弱点: 缓冲区越界读
研究员: @geeknik
披露日期: 2019-10-08
资产: IBB (Legacy)
CVE: CVE-2017-12986

该报告还没有中文解读。

原文摘录

摘自原文（1882 字符中的一小部分）

Reported to the devs on 4 February 2017. Tcpdump 4.9.2 released on 8 September 2017. Patch: https://github.com/the-tcpdump-group/tcpdump/commit/7ac73d6cd41e9d4ac0ca7e6830ca390e195bb21c

原文中的代码

/tcpdump -nr test000
reading from file test000, link-type IPV6 (Raw IPv6)
=================================================================
==567==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000e001 at pc 0x00000063663d bp 0x7ffec82f8fb0 sp 0x7ffec82f8fa8
READ of size 1 at …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2017-09-15报告提交
2019-10-08公开披露

阅读 HackerOne 原文 ↗作者 @geeknik · 版权归作者与 Internet Bug Bounty 所有

同类报告

Heap Buffer Overflow (READ: 4) in phar_parse_pharfileInternet Bug Bounty · 2020-10-10 Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflowInternet Bug Bounty · 2020-10-12 · $1,500 CVE-2024-7264: ASN.1 date parser overreadcurl · 2024-08-01 CVE-2024-7347: Buffer overread in the ngx_http_mp4_moduleInternet Bug Bounty · 2024-08-27 · $2,142 apache access.log leakage via long request on https://rapida.ru/QIWI · —CVE-2025-9086: Out of bounds read for cookie pathcurl · 2025-09-10