radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Alpine:v3.24 radvd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-r0"}]}]

参照URL

advisory security.alpinelinux.org