Handling of Overlapping IPv6 Fragments
updated by
- rfc-6946 — Processing of IPv6 "Atomic" Fragments
updates
- rfc-2460 — Internet Protocol, Version 6 (IPv6) Specification
Extracted elements (9)
The overlapping fragment attack is significantly more dangerous in IPv6 than in IPv4. In IPv4, the overlapping region of a TCP header typically does not include source and destination ports, but in IPv6 an attacker can craft overlapping fragments that replace the source or destination port, enabling broader bypass of port-based access controls.
The RFC 1858 mitigation for overlapping fragment attacks (dropping packets with fragment offset of 1) works for IPv4 but is ineffective for IPv6 because the fragmentable part of an IPv6 packet can contain extension headers before the TCP header, making the offset-based check unreliable.
This document updates RFC 2460 (the IPv6 base specification) to explicitly forbid overlapping fragments. The original RFC 2460 fragmentation and reassembly algorithm did not prevent fragments from overlapping.
IPv6 nodes transmitting datagrams that need to be fragmented MUST NOT create overlapping fragments.
Nodes MAY provide mechanisms to track the reception of overlapping fragment packets, for instance by implementing counters or alarms relating to these events.
When reassembling an IPv6 datagram, if one or more constituent fragments is determined to be an overlapping fragment, the entire datagram (and any constituent fragments, including those not yet received) MUST be silently discarded.
The IPv6 Fragment Header (Next Header value 44) includes a FragmentOffset field, a More Fragments (M) bit, and a 32-bit Identification field. The attack exploits the fact that two fragments with the same Identification value but overlapping offsets can carry contradictory upper-layer header content.
Overlapping IPv6 fragments can be used to bypass stateful firewalls: a first fragment carries a TCP SYN+ACK (appearing as a response to an initiated connection) to pass the firewall, while a subsequent overlapping fragment overwrites the TCP flags to change it to a SYN (connection request), effectively bypassing the firewall's access control.
This document recommends disallowing overlapping fragments in order to prevent the firewall-bypass attack described in Section 3. The fix is to silently discard any reassembly attempt that involves overlapping fragments.