IPv6 Jumbo Payload hop by hop header must be blocked.

From Firewall Security Technical Implementation Guide - Cisco

Part of IPV6 Jumbo payload hop by hop is not dropped

Associated with IA controls: ECSC-1

SV-20551r2_rule IPv6 Jumbo Payload hop by hop header must be blocked.

Vulnerability discussion

The IPv6 Jumbo Payload allows IP packets to be larger than 65,535 bytes. This feature is only useful on very specialized high performance systems (e.g. super computers). Common place link layer technologies do not support these payload sizes and special link layer designs would be necessary. This header should be dropped unless the system is specifically designed to use very large payloads, since it only serves as an opportunity to break implementations.

Check content

Review the device configuration to determine filters drop all inbound and/or outbound IPv6 packets containing a hop-by-hop option of option type 0xC2. If IPv6 Jumbo Payloads are not dropped, this is a finding. Alternatively, if the system is specifically designed to use very large payloads and its use is documented in architecture design documents, than this is not a finding.

Fix text

Configure the firewall to drop all inbound and/or outbound IPv6 packets containing a hop-by-hop option of option type 0xC2.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.