Bug 2558916 (CVE-2026-115449)

Summary: CVE-2026-115449 libslirp: libslirp: ICMP echo reply length desynchronization leaks host IP to guest
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 12:58:53 UTC 
A flaw was found in libslirp's ICMP echo request handling. In the function icmp_receive() in src/ip_icmp.c, after receiving an ICMP reply via recv(), the mbuf length (m_len) and IP header length (ip_len) are not updated to reflect the actual number of bytes received. They retain the original echo request size.

When the SOCK_DGRAM ICMP socket is unavailable (ping_group_range restricted) and slirp falls back to a SOCK_RAW socket, recv() can deliver ICMP error messages (such as Host Unreachable) instead of echo replies. These messages are shorter and contain an inner IP header with the host's real network address. The memmove path processes this data, and the stale m_len causes the inner IP header (including the host's real IP) to be included in the echo reply sent back to the guest. This breaks the NAT isolation that slirp user-mode networking provides.

The attack requires the guest to ping a nonexistent host on the hypervisor's local network while SOCK_DGRAM ICMP is restricted (which forces the raw socket fallback). No authentication or special privileges are needed on the guest side.

The leaked information is the host's real IP address (4 bytes of network metadata), not arbitrary host heap memory as originally reported.

Upstream fix: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788
Upstream issue: https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/105

Reported by: Piyusha Akash (manifoldoperations) via PSIRTSUPT-26209