[BUG]: IPv6 Amplification DoS in service_discovery_impl::process_eventgroupentry

vSomeip Version

7bcc1e06f16a774e70931ed641f475fbba9c8c64

Boost Version

1.9.0

Environment

Ubuntu 24.04

Describe the bug

Summary

The vsomeip Service Discovery module validates IPv4 endpoint addresses in SUBSCRIBE_EVENTGROUP processing via check_ipv4_address(), which rejects addresses that match the host's own unicast address or fall outside the host's subnet.

No equivalent validation exists for IPv6. Consequently, a crafted SUBSCRIBE carrying an IP6_ENDPOINT option with an arbitrary IPv6 address (including the host's own address or any remote address) is accepted. This enables an Amplification DoS attack: an attacker can forge a SUBSCRIBE with the victim's IPv6 address as the subscriber endpoint, causing the service to flood events to that victim. Unlike the IPv4 path (which at least restricts endpoints to the same subnet), the IPv6 path imposes no restrictions on the target address.

Path A (first IPv6 option) — service_discovery_impl.cpp:1820 :

                    if (its_first_port == ILLEGAL_PORT) {
                        its_first_address = its_ipv6_address;
                        its_first_port = its_ipv6_option->get_port();
                        is_first_reliable = (its_ipv6_option->get_layer_four_protocol() == layer_four_protocol_e::TCP);

                        if (is_first_reliable == is_second_reliable && its_second_port != ILLEGAL_PORT) {
                            if (its_ttl > 0) {
                                insert_subscription_ack(_acknowledgement, its_info, 0, nullptr, its_clients);
                            }
                            VSOMEIP_ERROR_P << "Multiple IPv6 endpoint options of same kind referenced! " << its_sender.to_string()
                                            << " session: " << hex4(its_session) << its_session
                                            << " is_first_reliable: " << is_first_reliable;
                            return;
                        }

Path B (second IPv6 option) — service_discovery_impl.cpp:1834:

                    } else if (its_second_port == ILLEGAL_PORT) {
                        its_second_address = its_ipv6_address;
                        its_second_port = its_ipv6_option->get_port();
                        is_second_reliable = (its_ipv6_option->get_layer_four_protocol() == layer_four_protocol_e::TCP);

                        if (is_second_reliable == is_first_reliable && its_first_port != ILLEGAL_PORT) {
                            if (its_ttl > 0) {
                                insert_subscription_ack(_acknowledgement, its_info, 0, nullptr, its_clients);
                            }
                            VSOMEIP_ERROR_P << "Multiple IPv6 endpoint options of same kind referenced! " << its_sender.to_string()
                                            << " session: " << hex4(its_session) << its_session << its_session
                                            << " is_second_reliable: " << is_second_reliable;
                            return;
                        }

Reference — IPv4 validation (service_discovery_impl.cpp:1764, :1789)

                        if (!check_ipv4_address(its_second_address) || 0 == its_second_port) {
                            if (its_ttl > 0) {
                                insert_subscription_ack(_acknowledgement, its_info, 0, nullptr, its_clients);
                            }
                            VSOMEIP_ERROR_P << "Invalid port or IP address in second IPv4 endpoint option specified! "
                                            << its_sender.to_string() << " session: " << hex4(its_session);
                            return;
                        }

Root Cause

The IPv4 validation function check_ipv4_address (service_discovery_impl.cpp:2330–2353) performs two checks:

• Rejects if the endpoint address equals the host's unicast address.
• Rejects if the endpoint address is not in the same subnet as the host ((self & netmask) != (remote & netmask)).

No equivalent function exists for IPv6.

Reproduction Steps

• vsomeip built and running with IPv6 configuration (unicast e.g. fd00::2/64)
• A service (e.g. notify-sample) offering an eventgroup

Expected behaviour

No response

Logs and Screenshots

In the same environment, ipv4 is blocked as below.

2026-07-13 13:25:04.897994 notify-sample [error] Subscriber's IP isn't in the same subnet as host's IP: 10.10.1.99
2026-07-13 13:25:04.898015 notify-sample [error] sdi::process_eventgroupentry: Invalid port or IP address in first IPv4 endpoint option specified! 10.10.0.100 session: 0001

In the same environment, ipv6 is acceptable.

2026-07-13 13:18:10.086403 notify-sample [info] KPI NET4 First SD unicast message from fd00::100
2026-07-13 13:18:10.086990 notify-sample [info] SUBSCRIBE(0000): [1234.5678.4465:ffff:0] true
2026-07-13 13:18:10.087351 notify-sample [info] SUBSCRIBE(0000): [1234.5678.4465:ffff:0] accepted. id=0001 subscribers=1
2026-07-13 13:18:10.087637 notify-sample [info] event::notify_one_unlocked: Notifying 1234.5678.8778 failed. Event payload not (yet) set!
2026-07-13 13:18:10.087716 notify-sample [info] REMOTE SUBSCRIBE(0000): [1234.5678.4465] from fd00:1::99:30509 unreliable was accepted. id=0001
2026-07-13 13:18:10.087757 notify-sample [info] SUBSCRIBE ACK(1277): [1234.5678.4465.ffff] id=0001

Start in service_discovery_impl.cpp at process_eventgroupentry and compare the IPv6 endpoint handling around lines 1820 and 1834 with the IPv4 validation around lines 1764, 1789, and 2330-2353. Determine the appropriate IPv6 endpoint checks, then verify with the described IPv6 configuration and crafted SUBSCRIBE scenario that invalid targets are rejected without breaking valid subscriptions.