PT-2021-15423 · Unknown · Gargoyle Os

Published 2021-04-12 · Updated 2021-04-27 · CVE-2021-23270

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gargoyle OS version 1.12.0

Description A routing loop can occur when IPv6 is used, generating excessive network traffic between an affected device and its upstream ISP's router. This happens when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

Recommendations For Gargoyle OS version 1.12.0, consider disabling IPv6 support temporarily to prevent the routing loop issue until a patch is available. Restrict access to the affected link prefix route to minimize the risk of exploitation. Avoid using the on-link flag in router advertisements for global unique IPv6 prefixes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-834

Related Identifiers

CVE-2021-23270

Affected Products

Gargoyle Os

References · 4

• https://github.com/ericpaulbishop/gargoyle/commit/24afe944a6ffff53d84a748384e276a4e95912ec · Patch
• https://osv.dev/vulnerability/CVE-2021-23270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23270 · Security Note
• https://t.me/cvenotify/13117 · Telegram Post