CVE-2022-27881
📋 TL;DR
This is a heap buffer overflow vulnerability in OpenBSD's slaacd daemon, triggered by malicious IPv6 router advertisements containing more than seven nameserver entries. It affects OpenBSD systems with IPv6 enabled, potentially allowing remote code execution or denial of service. The vulnerability is mitigated by OpenBSD's privilege separation and pledge security mechanisms.
💻 Affected Systems
- OpenBSD
📦 What is this software?
Openbsd by Openbsd
Openbsd by Openbsd
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise
Likely Case
Denial of service (slaacd crash) or limited code execution within pledge constraints
If Mitigated
Denial of service only, with privilege separation preventing full system compromise
🎯 Exploit Status
Exploit requires crafting malicious IPv6 router advertisements; detailed analysis available in public blog posts
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenBSD 6.9-stable after 2022-02-21, 7.0-stable after 2022-02-21
Vendor Advisory: https://ftp.openbsd.org/pub/OpenBSD/patches/
Restart Required: Yes
Instructions:
1. Apply the official patch from OpenBSD: 6.9: 030_slaacd.patch, 7.0: 014_slaacd.patch
2. Rebuild and reinstall slaacd
3. Restart the slaacd service or reboot the system
🔧 Temporary Workarounds
Disable IPv6 Router Advertisement Processing
openbsdPrevent slaacd from processing router advertisements
rcctl disable slaacd
rcctl stop slaacd
Network Filtering
allBlock malicious router advertisements at network perimeter
Configure firewall to filter ICMPv6 type 134 packets with suspicious payloads
🧯 If You Can't Patch
- Disable slaacd service entirely if IPv6 autoconfiguration is not required
- Implement strict network segmentation to limit exposure to untrusted IPv6 networks
🔍 How to Verify
Check if Vulnerable:
Check OpenBSD version: uname -a. If version is 6.9 or 7.0 and patch date is before 2022-02-21, system is vulnerableCheck Version:
uname -aVerify Fix Applied:
Verify patch is applied: pkg_info | grep slaacd or check if /usr/sbin/slaacd has been updated after 2022-02-21📡 Detection & Monitoring
Log Indicators:
- slaacd crash logs in /var/log/messages
- Unexpected slaacd process termination
Network Indicators:
- Malformed IPv6 router advertisements with >7 nameserver entries
- ICMPv6 type 134 packets with abnormal payload sizes
SIEM Query:
source="*/messages" AND "slaacd" AND ("crash" OR "segmentation fault" OR "abnormal termination")🔗 References
- https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html
- https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.sig
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.sig
- https://security.netapp.com/advisory/ntap-20220506-0005/
- https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html
- https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.sig
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.sig
- https://security.netapp.com/advisory/ntap-20220506-0005/
