A flaw was found in libslirp's ICMP echo request handling. In the function icmp_receive() in src/ip_icmp.c, after receiving an ICMP reply via recv(), the mbuf length (m_len) and IP header length (ip_len) are not updated to reflect the actual number of bytes received. They retain the original echo request size.

When the SOCK_DGRAM ICMP socket is unavailable (ping_group_range restricted) and slirp falls back to a SOCK_RAW socket, recv() can deliver ICMP error messages (such as Host Unreachable) instead of echo replies. These messages are shorter and contain an inner IP header with the host's real network address. The memmove path processes this data, and the stale m_len causes the inner IP header (including the host's real IP) to be included in the echo reply sent back to the guest. This breaks the NAT isolation that slirp user-mode networking provides.

The attack requires the guest to ping a nonexistent host on the hypervisor's local network while SOCK_DGRAM ICMP is restricted (which forces the raw socket fallback). No authentication or special privileges are needed on the guest side.

The leaked information is the host's real IP address (4 bytes of network metadata), not arbitrary host heap memory as originally reported.

Upstream fix: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788
Upstream issue: https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/105

Reported by: Piyusha Akash (manifoldoperations) via PSIRTSUPT-26209