IPv6 Routing Loop Vulnerability in Gargoyle OS by Eric Paul Bishop
CVE-2021-23270

7.5HIGH

Key Information:

Vendor

Gargoyle-router

Status
Gargoyle
Vendor
CVE Published:
12 April 2021

What is CVE-2021-23270?

In Gargoyle OS version 1.12.0, an IPv6 routing loop vulnerability can result in significant network congestion between a device and its upstream ISP's router. This issue manifests when a link prefix route directs traffic to a point-to-point link, and a destination IPv6 address falls within the prefix but is not designated as a local IPv6 address. The situation is exacerbated by receiving a router advertisement containing at least one globally unique IPv6 prefix with the on-link flag set, leading to repeated excessive traffic in the network.

References

https://github.com/ericpaulbishop/gargoyle/commit/24afe94...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-23270 : IPv6 Routing Loop Vulnerability in Gargoyle OS by Eric Paul Bishop