OpenBSD - Remote Kernel MPLS Stack Disclosure · Argus Proof of Possession
pop.argus-systems.ai

mpls_do_error copies (nstk+1) label-stack entries from a fixed 16-entry array when no BoS label is present, leaking 4 bytes of adjacent kernel stack memory in the ICMP/MPLS error response.