CVE-2024-23911

Executive Summary

CVE-2024-23911 is a critical out-of-bounds read vulnerability in Cente middleware TCP/IP Network Series. The flaw resides in the improper validation of option length values within IPv6 Neighbor Discovery Protocol (NDP) packets. An unauthenticated attacker can exploit this by sending a specially crafted IPv6 NDP packet, potentially causing a denial-of-service (DoS) condition by stopping device operations. No public exploit code or patch is currently available, and the CVSS score is listed as 0.0, indicating incomplete scoring data. The vulnerability affects Cente’s proprietary TCP/IP stack, commonly used in embedded and industrial control systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It targets a proprietary embedded TCP/IP stack (Cente middleware) used in industrial and IoT devices. Supply chain risk is elevated due to the lack of a patch and the difficulty of updating embedded firmware in the field.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error in the NVD record. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attack is launched over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the only one affected.
• Confidentiality (C): None (N) – out-of-bounds read does not leak data in this context.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – device operations are stopped.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High – due to network-based, unauthenticated DoS potential in critical infrastructure.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds read (CWE-125) in the IPv6 NDP packet parser of Cente middleware TCP/IP Network Series. IPv6 NDP uses ICMPv6 messages (e.g., Neighbor Solicitation, Neighbor Advertisement, Router Solicitation, Router Advertisement) that include options with Type-Length-Value (TLV) fields. The flaw occurs when the software fails to properly validate the length field of these options before reading the option data.

Technical Flow:

1. An attacker crafts an IPv6 NDP packet with a malicious option.
2. The option’s length field is set to a value larger than the actual remaining packet data.
3. The Cente TCP/IP stack reads beyond the allocated buffer, causing an out-of-bounds read.
4. This read may access unmapped memory or trigger a fault, leading to a crash or hang of the device.

Impact: Denial of service (device stop). No code execution is implied, but the DoS can be persistent if the device does not automatically recover.

Vulnerable vs. Patched Code

No patch is available, and the exact vulnerable code is not publicly disclosed. However, the fix would involve adding bounds checking before reading option data:

Vulnerable (pseudocode):

void parse_ndp_option(uint8_t *option, uint16_t remaining_len) {
    uint8_t type = option[0];
    uint8_t len = option[1]; // No validation
    uint8_t *data = &option[2];
    // Read len bytes from data – out-of-bounds if len > remaining_len - 2
    process_option(type, data, len);
}

Patched (pseudocode):

void parse_ndp_option(uint8_t *option, uint16_t remaining_len) {
    uint8_t type = option[0];
    uint8_t len = option[1];
    if (len < 2 || len > remaining_len) {
        // Invalid option length, discard
        return;
    }
    uint8_t *data = &option[2];
    process_option(type, data, len - 2);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to the target network (IPv6 enabled).
• Ability to send raw IPv6 packets (e.g., using Scapy, hping3, or custom C code).

Exploit Concept: Since no public exploit exists, a proof-of-concept can be developed using Scapy to send a malformed IPv6 NDP packet.

Scapy PoC:

#!/usr/bin/env python3
from scapy.all import *

# Target IPv6 address
target_ip = "fe80::1"

# Craft a malformed Neighbor Solicitation with oversized option length
pkt = IPv6(dst=target_ip) / ICMPv6ND_NS(tgt=target_ip) / ICMPv6NDOptMTU(len=255)  # Invalid length

send(pkt, iface="eth0")

Explanation: The ICMPv6NDOptMTU option normally has a length of 1 (8 bytes). Setting len=255 causes the parser to read far beyond the packet, triggering the out-of-bounds read.

Lab Setup:

• Use a virtual machine running Cente middleware (if available) or a device with the vulnerable stack.
• Attacker machine: Kali Linux with Scapy.
• Monitor device logs or console for crash/hang.

Blue Team (Defensive)

Detection:

• Monitor for IPv6 NDP packets with option length fields exceeding expected values (e.g., MTU option length > 1, prefix info length > 4).
• Use network intrusion detection systems (NIDS) to flag anomalous NDP packets.

Mitigation:

• If possible, disable IPv6 on affected devices until a patch is available.
• Implement network segmentation to limit exposure of vulnerable devices.
• Use firewall rules to drop malformed IPv6 NDP packets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • IPv6 NDP packets with option length fields set to abnormally high values (e.g., > 255 for a single option).
  • ICMPv6 type 135 (Neighbor Solicitation) or 136 (Neighbor Advertisement) with malformed TLV options.
• Host IOCs:
  • Device logs showing unexpected crashes or hangs related to IPv6 NDP processing.
  • Memory dumps indicating out-of-bounds reads in the TCP/IP stack.

Detection Engineering

YARA Rule

rule CVE_2024_23911_IPv6_NDP_OOB_Read {
    meta:
        description = "Detects malformed IPv6 NDP packets with oversized option lengths"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-23911"
    strings:
        $ndp_ns = { 87 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? }  // ICMPv6 Neighbor Solicitation
        $ndp_na = { 88 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? }  // ICMPv6 Neighbor Advertisement
        $option_mtu = { 04 }  // MTU option type
        $option_prefix = { 03 }  // Prefix info option type
    condition:
        (($ndp_ns or $ndp_na) and ($option_mtu or $option_prefix)) and
        for any of ($option*) : (
            // Check if length field (byte after type) is > expected max
            @ > 0 and uint8(@ + 1) > 10  // Arbitrary threshold
        )
}

Sigma Rule

title: CVE-2024-23911 - Malformed IPv6 NDP Packet Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects IPv6 NDP packets with option length fields exceeding normal values
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001
    condition: selection
fields:
    - src_ip
    - dest_ip
    - alert.signature
falsepositives:
    - Legitimate but unusual NDP options (rare)
level: high

Suricata Rule

alert icmp6 any any -> any any (msg:"CVE-2024-23911 - Malformed IPv6 NDP Option Length"; icode:0; itype:135; content:"|04|"; offset:4; depth:1; byte_test:1,>,10,5; sid:3000001; rev:1;)
alert icmp6 any any -> any any (msg:"CVE-2024-23911 - Malformed IPv6 NDP Option Length"; icode:0; itype:136; content:"|04|"; offset:4; depth:1; byte_test:1,>,10,5; sid:3000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable IPv6 on affected Cente middleware devices if not required for operations.
2. Network Segmentation: Isolate vulnerable devices behind firewalls that can inspect and drop malformed IPv6 packets.
3. Monitor: Deploy the provided Suricata rules to detect exploitation attempts.

Long-term Fix:

• Contact Cente for a firmware patch. Since no patch is available, consider replacing the middleware with a patched alternative.
• Implement input validation in the NDP parser (bounds checking on option lengths).

Workarounds:

• Use IPv4-only networks if IPv6 is not essential.
• Apply ACLs to restrict NDP traffic to trusted sources only.

Valters IT