Linux Kernel: Content-Length Truncation in netfilter SIP Tracker

Overview

CVE	CVE-2026-23457
Component	net/netfilter/nf_conntrack_sip.c (sip_help_tcp())
Affected	64-bit Linux systems using the SIP conntrack helper
Fixed	Linux v6.14 and stable backports (fbce58e719a1)
Class	CWE-190 (Integer Overflow or Wraparound)
CVSS v3.1	8.6 (High, kernel.org CNA) -- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Found and patched by	Lukas Johannes Moeller (@JohannesLks)

TL;DR

sip_help_tcp() parses Content-Length into an unsigned long and then truncates it into a 32-bit unsigned int. On 64-bit systems, Content-Length: 4294967328 becomes 32, so the helper computes the wrong SIP message boundary and may parse trailing TCP bytes as a second SIP message.

Root Cause

unsigned int matchoff, matchlen, clen;

clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
// simple_strtoul() returns unsigned long

The type mismatch matters only where unsigned long is wider than unsigned int. On x86_64, values above UINT_MAX wrap before the parser computes msglen = headers + clen.

Header	Stored clen	Parser effect
4294967328	32	Message boundary shortened by 2^32 bytes
4294967296	0	Body treated as absent

Impact

This was initially reported as a possible firewall bypass. Maintainer review clarified the security boundary: conntrack helpers assist protocol tracking and NAT expectations, but they are not designed to be a policy-enforcing SIP parser. The final impact is therefore parser desynchronization and correctness, not a claimed bypass of a supported security boundary.

Fix

The fix keeps the parsed value at the correct width and rejects impossible lengths before boundary calculation:

- unsigned int matchoff, matchlen, clen;
+ unsigned int matchoff, matchlen;
+ unsigned long clen;

clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
if (clen > datalen)
    break;

The important part is not only widening the variable; it is also bounding the declared body length against the remaining TCP payload.