# IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements

Root container with CAP_NET_RAW sends rogue IPv6 router advertisements to reconfigure host IPv6 stack, redirecting host traffic to attacker container for MitM.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by: champtar
- Disclosed: 2021-11-07
- CVE: CVE-2019-9946, CVE-2019-3462
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/819717
- Library page: https://bugbountylibrary.com/r/h1%3A819717
- Tags: area:devices domain:cloud domain:network impact:internal-access kind:bounty platform:hackerone sev:medium tech:kubernetes tech:linux technique:source-review vuln:misconfiguration

**Target:** CNI veth interface / host IPv6 stack (accept_ra)
**Root cause:** CNI-managed interfaces default to accept_ra=1 with IPv6 forwarding disabled, so hosts accept router advertisements from containers and reconfigure their IPv6 stack.
**Steps:**
1. Confirm host has IPv6 not disabled (no ipv6.disable=1) and /proc/sys/net/ipv6/conf/*/accept_ra == 1, forwarding == 0
2. From root container with CAP_NET_RAW, send rogue IPv6 router advertisements via veth to host
3. Host adopts attacker-advertised IPv6 prefix/route, redirecting IPv6 traffic to attacker container
4. Attacker implements user-space TCP/IP stack (smoltcp PoC) and dummy HTTP server on any IPv6 address to intercept traffic
5. Leverage A/AAAA DNS records so HTTP libraries try IPv6 first, capturing requests
**How found:** Observed that CNI veth setups leave accept_ra=1 while IPv6 forwarding is off, meaning hosts honor RAs from containers; built a smoltcp-based PoC to confirm traffic redirection.
**Exploitation:** Attacker with root in a pod and CAP_NET_RAW crafts router advertisements over the veth link; host reconfigures IPv6 routing to send traffic to the container, where a user-space stack answers as any IPv6 address, intercepting host traffic without CAP_NET_ADMIN.
**Escalation:** Chain with a host-side vulnerability such as apt RCE (CVE-2019-3462) to escalate from MitM to host compromise.
**Insight:** Check sysctl defaults (accept_ra, forwarding) on interfaces reachable from untrusted containers; a container with only CAP_NET_RAW can still inject L2/L3 control-plane packets like router advertisements to hijack host routing.