CVE-2020-16898: "Bad Neighbor" IPv6 RCE

Executive Summary

Nicknamed "Bad Neighbor", CVE-2020-16898 is a devastating vulnerability in the Windows implementation of the IPv6 protocol stack (tcpip.sys). It enables an unauthenticated attacker to cause a Blue Screen of Death (BSOD) or execute arbitrary code at the highest level of privilege—the Windows Kernel (SYSTEM context)—simply by sending a specially crafted ICMPv6 router advertisement.

With a CVSS of 9.8, this exploit ranks among the most threatening architectural vulnerabilities for modern local area networks (LANs).

CRITICAL

---

Technical Details

The vulnerability lies in how Microsoft's tcpip.sys driver parses the ICMPv6 Router Advertisement (RA) packets.

In IPv6, Router Advertisements are used by routers to notify local nodes of their presence, linking prefixes, and routing configurations. These packets contain sub-options such as the Recursive DNS Server (RDNSS) option.

The Buffer Overflow Mechanism

1. When tcpip.sys encounters an RDNSS option within a Router Advertisement, it inspects the length field.
2. The developer parsing the memory allocated a fixed, predictable pool of memory based on standard size constraints.
3. The validation check against the Length field in the RDNSS option was flawed.
4. By supplying an unexpectedly large length value and padding it with junk data, an attacker causes the memory copy function (RtlCopyMemory or equivalent) to overwrite adjacent kernel pool memory.
5. This overrun corrupts essential kernel structures, granting the attacker the ability to control execution pointers.

[!WARNING] This vulnerability permits attackers to bypass standard security boundaries due to an intrinsic networking stack flaw routing ICMPv6 packets. There are absolutely no authentication checks. Immediate patching is required.

---

Vulnerability Assessment

Precogs Threat Intelligence assigns a Critical severity rating for its immediate enterprise infrastructure impact:

• Exploitability Metrics: Trivial execution using maliciously crafted ICMPv6 Router Advertisement packets over the network.
• Impact Metrics: Complete host takeover allowing unauthenticated Remote Code Execution or blue-screen Denial of Service.
• Environmental Context: All modern Windows systems with IPv6 enabled are fundamentally exposed to arbitrary adjacent payloads.

---

Code Fixes & Remediation Samples

The root cause of "Bad Neighbor" occurs in tcpip.sys when parsing the Recursive DNS Server (RDNSS) option of a Router Advertisement packet.

Vulnerable Code Example (Conceptual tcpip.sys execution)

// When processing ICMPv6 RDNSS Options
void ProcessRDNSSOption(PBUF Buffer) {
    // Uses the attacker-controlled 'Length' field directly to allocate memory
    ULONG length = Buffer->Length * 8; 
    
    // An even length requirement is circumvented if the length option is artificially massive
    PVOID allocatedMemory = ExAllocatePoolWithTag(NonPagedPool, length, 'NDSR');
    
    // Buffer overflow across non-paged kernel pool memory
    memcpy(allocatedMemory, Buffer->Data, length);
}

Secure Code Example (Remediated Logic)

The patch introduces explicit upper threshold constraints ensuring that RDNSS options never exceed predefined ICMP boundaries.

void ProcessRDNSSOption(PBUF Buffer) {
    // Strictly validate that length corresponds correctly to the number of DNS servers
    // Minimum length is 3 (header + 1 IPv6 address), and it must be an odd number
    if (Buffer->Length < 3 || (Buffer->Length % 2) == 0) {
        DropPacket(Buffer);
        return;
    }

    ULONG length = Buffer->Length * 8; 
    // Enforce an absolute maximum size to prevent memory exhaustion/overflow
    if (length > MAX_RDNSS_OPTION_SIZE) {
        DropPacket(Buffer);
        return;
    }
    
    PVOID allocatedMemory = ExAllocatePoolWithTag(NonPagedPool, length, 'NDSR');
    memcpy(allocatedMemory, Buffer->Data, length);
}

---

How to Fix and Mitigate CVE-2020-16898

Because RA packets are processed immediately by the network stack to maintain continuous local connection states, the exploit executes instantaneously upon receipt, sidestepping authentication entirely.

Impact

The sheer ubiquity of IPv6 on modern Windows machines amplifies the severity. Because ICMPv6 packets are generally confined to the local broadcast domain (they aren't routable across the public WAN), this attack typically originates from:

• Inside Threats: An infected machine, IoT device, or malicious insider on the corporate Wi-Fi network.
• Wormable Pivoting: After a low-tier breach (like an email phishing payload), the malware utilizes Bad Neighbor to instantly jump sideways to domain controllers and critical infrastructure servers on the same VLAN, completely elevating access from User to SYSTEM.

---

Remediation

1. Vendor Patching

Microsoft resolved this via an out-of-band security update fixing the bounds checking in tcpip.sys. The priority is to push updates to Windows 10 Version 1709-2004 and Windows Server versions 1903-2004.

2. Network Isolation Strategies

Disable ICMPv6 Router Discovery via PowerShell on environments where stateless auto-configuration is not strictly required.

# Disable ICMPv6 RDNSS parsing temporarily
netsh int ipv6 set int * rabaseddnsconfig=disable

3. Switch-Level Mitigation

Ensure your enterprise core switches have IPv6 RA Guard configured. RA Guard inspects incoming Router Advertisements and drops them if they originate from an untrusted switch port (e.g., an endpoint device port rather than an actual physical router uplink).