A flaw in libslirp causes the ICMP echo reply length to be left unchanged while the payload length varies with the host data received. When the normal ICMP socket cannot be used, this mis‑synchronization results in the host’s real IP address being embedded in the echo reply sent back to the guest VM. The information leak defeats the expected NAT isolation between the host and guest networks, exposing a private IP address that should remain concealed.

Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, all versions that employ libslirp for user‑mode networking.

The reported CVSS score of 3.5 indicates a moderate risk, and the exploit probability remains unknown due to the unavailability of a current EPSS rating. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker with control over a guest virtual machine sending crafted ICMP echo requests that trigger the vulnerable raw socket path. Under those conditions, the host’s private IP is leaked to the guest, enabling an attacker to identify internal network details that should be isolated by NAT.