Loading story…
Arista EOS 4.33.0F introduced per-VRF support for RFC 5837 Extended ICMP Errors on all platforms except containerized EOS (cEOS). Operators can restrict the feature with an ACL; ICMP error extensions can expose interface identifiers, interface names, MTU values, and IP addresses to compatible traceroute tools. Testing also found optional Node ID extension codepoints apparently carrying a hostname, which triggered Wireshark parsing failures; packet captures and device configurations were published for review.
Tooling support is developing alongside the network implementation. traceroute 2.1.4, included with Ubuntu 24.04 LTS and Debian Trixie, supports RFC 5837 via its -e option, while Trippy can show unknown extensions in ICMP-extension mode. Feature requests backed by production captures were filed for Trippy and the Rust-based ttl traceroute and path-monitoring tool, which already provides MPLS-label parsing, ECMP detection, path-MTU discovery, and export and Prometheus-oriented monitoring capabilities.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Lukas Tribus documented that Arista EOS supports RFC 5837 Extended ICMP Errors from EOS 4.33.0F on all platforms except cEOS. He published packet captures and configurations from testing, reported Wireshark parsing failures with optional Node ID extension codepoints, and filed implementation requests with Trippy and ttl.
Lukas Tribus stated that feature requests based on production traceroute captures had been filed for Trippy and ttl. He noted that Trippy can display unknown extensions in ICMP-extension mode and that traceroute 2.1.4 supports RFC 5837 via its -e option, including in Ubuntu 24.04 LTS and Debian Trixie.
Bryan Holloway stated that Arista EOS added RFC 5837 extended-ICMP-error support for non-default VRFs in EOS 4.35.2F. He said the feature is enabled per VRF and can be restricted with access-control lists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A remotely triggerable out-of-bounds read vulnerability was disclosed in `traceroute` 2.1.2, affecting MPLS extension parsing when the tool is run with `-e`. Researcher Mohamed Aziz Rahmouni reported that in `traceroute/traceroute.c`, the packet buffer pointer is advanced past the IP header after `recvmsg()`, but the packet length variable is not reduced before `handle_extensions()` is called. That mismatch can cause the parser to read past the actual received packet boundary and into uninitialized stack memory in `buf[1280]` when processing a crafted ICMP Time Exceeded response carrying MPLS extensions from an on-path network device. The researcher said the flaw was identified through manual code review and dynamic fuzzing, confirmed with a working proof of concept, and could be corrected with a one-line fix that subtracts the header length from the packet length after advancing the buffer pointer. traceroute maintainer Dmitry Butskoy acknowledged the report on the `oss-sec` mailing list and said he would review it within hours, while the disclosure followed a 90-day responsible disclosure timeline with public technical details planned unless a patch is released sooner.
Jun 29, 2026
AWS published security bulletins for multiple vulnerabilities in **FreeRTOS-Plus-TCP**, including **`CVE-2026-7424`**, an integer underflow in the DHCPv6 sub-option parser. A separate advisory also disclosed a **MAC address validation bypass** and an **integer underflow in ICMP Echo Reply processing**, indicating that several network stack components can mishandle crafted traffic. The issues affect packet parsing and validation logic in FreeRTOS-Plus-TCP, raising the risk that specially formed network input could bypass expected checks or trigger memory-handling errors in embedded and IoT deployments using the stack. The advisories identify the flaws as distinct but related weaknesses in low-level networking code, underscoring the need for organizations running FreeRTOS-based devices to review AWS guidance and apply available fixes or mitigations.
Jun 29, 2026
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026