OpenBSD slaacd/rad Infinite Loop via Malformed ND Option (CVE-2026-41285)

Metadata

Affected Target

Summary

slaacd and rad each contain their own userland parser for ICMPv6 Neighbor Discovery (ND) options, separate from the kernel’s already-correct nd6_options() validation. Their parsing loop computes optlen = nd_opt_len * 8 - 2, and when an attacker sends an ND option with nd_opt_len == 0, this evaluates to -2, which — due to signed/unsigned promotion — fails to trigger the loop’s bounds-check guard. The loop pointer then effectively regresses instead of advancing, spinning the daemon’s engine process at 100% CPU forever. A single 18-byte crafted ICMPv6 Router Advertisement (or Router Solicitation, for rad) from any host on the local network segment permanently disables IPv6 SLAAC address autoconfiguration until the daemon is manually restarted. The repository includes both a minimal one-packet exploit and a full before/after proof script that verifies SLAAC works, sends the exploit, and confirms subsequent legitimate RAs are ignored.

Vulnerability Details

Root Cause

nd_opt->nd_opt_len * 8 - 2, where nd_opt_len is a uint8_t, promotes to a signed int and evaluates to -2 when nd_opt_len == 0; the subsequent bounds check (optlen > len) is always false against a positive len, so the parser never rejects the zero-length option and the loop fails to advance, spinning forever — a bug class the kernel already guards against but that both userland daemons repeat independently.

Attack Vector

1. Attacker on the same L2 segment as the OpenBSD target crafts an ICMPv6 Router Advertisement containing one ND option with nd_opt_type set to any value and nd_opt_len = 0.
2. The packet is sent via multicast (ff02::1) using sendp() on the local interface — no authentication or prior state required.
3. slaacd’s (or rad’s) engine process receives the RA/RS and enters its ND-option parsing loop, which never terminates due to the arithmetic underflow.
4. The engine process pegs at 100% CPU and stops processing all further Router Advertisements, so SLAAC addressing eventually goes stale as existing addresses expire.

Impact

Permanent, remote, unauthenticated denial of service against IPv6 autoconfiguration on any OpenBSD host reachable on the local network segment; recovery requires manual daemon restart or reboot.

Environment / Lab Setup

Target:   OpenBSD 7.8 GENERIC amd64 running slaacd (or rad) on an IPv6-enabled interface
Attacker: Python 3 + scapy, raw-socket/root privileges, on the same L2 segment (VM lab tested with VMware Network Adapter VMnet8); prove_dos.py additionally uses paramiko for SSH-based verification

Proof of Concept

PoC Script

See kill_slaacd.py and prove_dos.py in this folder.

1
2

python3 kill_slaacd.py <interface>
python3 prove_dos.py   # full before/after end-to-end proof (edit TARGET_IP/IFACE first)

kill_slaacd.py sends a single crafted Router Advertisement with one ND option (type=200, len=0) over the given interface, which is enough to hang the target’s slaacd engine indefinitely. prove_dos.py automates the complete demonstration over SSH: it restarts slaacd, sends a legitimate RA to confirm SLAAC is working, fires the exploit packet, then sends a second legitimate RA and shows it is silently ignored — proving the daemon is dead — before restarting the service.

Detection & Indicators of Compromise

Signs of compromise:

• slaacd/rad engine process CPU usage stuck near 100% with no drop-off
• IPv6 SLAAC addresses expiring without renewal on affected interfaces
• Unusual ICMPv6 RA/RS traffic on the local segment with anomalously small ND option lengths

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Rat5ak/CVE-2026-41285-OpenBSD-v6daemons-go-brrr on 2026-07-05.