Contributions & Advisories

When generating an ICMP error packet, icmp_forward_error() derived the quoted original IPv4 packet length directly from the packet IP header without clamping it to the actual packet buffer size. A truncated or malformed packet triggers an out-of-bounds heap read, leaking host memory back to guest virtual machines or containers.

When transitioning a session from the fast queue to the batch queue, if_output() improperly unlinked and reinserted an arbitrary packet via ifm->m_nextpkt rather than the session queue head. This corrupted packet queue pointers, allowing guest burst traffic to crash the host networking process and cause a Denial of Service (DoS).

In both icmp_receive() and icmp6_receive(), the length field of echo reply packets is not correctly synchronized with actual received payload size. Under specific conditions where the normal ICMP socket is unavailable, this causes trailing uninitialized buffer bytes containing the host's actual IP to be emitted to the guest, breaking NAT isolation.

tftp_server_name is heap-allocated during initialization but never freed in the cleanup path slirp_cleanup(), causing a persistent memory leak on every instance teardown in QEMU and other consumers of libslirp.

When a TFTP read request (RRQ) is received with an empty filename, tftp_handle_rrq() performs pointer arithmetic that results in a buffer underflow — reading memory before the start of the allocated buffer. This can cause undefined behavior and potential memory exposure.

In icmp6_receive(), an IPv4 ICMP_UNREACH error is incorrectly emitted using the ICMPv6 send path. This protocol type mismatch causes malformed packets to be constructed and sent, breaking network error signaling for IPv4 unreachable conditions handled through the IPv6 receive path.

In fork_exec(), two connected socket descriptors allocated via slirp_socketpair_with_oob() are never closed if argument parsing fails prior to the fork. Repeated failures in callers will exhaust the host process file descriptor table, resulting in denial of service for guest networking.

In slirp_state_load(), if deserialization or validation of a socket fails partway through, the already-allocated socket structure and its associated send/receive buffers are not freed before returning an error. This results in heap memory and buffer leaks on failed state restore operations.

tcp_emu() used a static local variable to maintain parser state across calls. Because static local variables are shared across all call sites in a process, concurrent or interleaved sessions corrupted each other's protocol parser state — causing silent protocol parsing failures in multi-instance libslirp environments.