Piyusha Akash

A flaw was discovered in libslirp within icmp_forward_error() when constructing ICMP error responses. The length of the quoted original IPv4 packet was derived directly from the IP header without verifying or clamping it against actual available buffer boundaries.

A malformed or truncated packet received from an unprivileged guest triggers an out-of-bounds heap read, leaking sensitive host memory into the ICMP error packet returned to the guest or container.

A memory queue management flaw was identified in libslirp's if_output() function during fast-to-batch queue transitions. The routine operated on an arbitrary packet via ifm->m_nextpkt instead of unlinking and reinserting the session queue head, corrupting internal queue pointers.

A guest generating burst network traffic can reliably trigger memory queue corruption and crash the host networking process, causing a complete Denial of Service (DoS).

When handling ICMP echo requests where the fallback ICMP socket path is engaged, libslirp failed to synchronize reply packet lengths to actual bytes received from the host OS network stack.

This length mismatch causes uninitialized packet buffer slices containing the host machine's physical IP address to be returned in echo replies, breaching guest NAT isolation.