Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <50dfd9cf-a4c8-9b4c-6419-91f68ca45e88@di.uniroma1.it>
Date: Fri, 8 Sep 2023 19:48:21 +0200
From: Enrico Bassetti <bassetti@...uniroma1.it>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-4809: FreeBSD pf bypass when using IPv6

Hello *,

A few months ago, as part of our investigations on IPv6 security in the 
NetSecurityLab @ Sapienza University, we discovered a vulnerability that 
allows attackers to bypass rules in pf-based IPv6 firewalls in 
particular conditions.

Vulnerability (TL;DR)
==============
A FreeBSD with `pf` as firewall for IPv6 traffic and `scrub` enabled to 
reassemble IPv6 fragments is vulnerable to an attack that uses a crafted 
packet posing as IPv6 "atomic" fragment to bypass the rules. After the 
fragment is matched against some firewall rules (but not all!), it is 
then "corrected" and forwarded to the destination (if no "deny" rule is 
matched).


References
==============
This vulnerability has been assigned the ID CVE-2023-4809.

The FreeBSD advisory is at
https://www.freebsd.org/security/advisories/FreeBSD-SA-23:10.pf.asc

We wrote a description with an example at:
https://www.enricobassetti.it/2023/09/cve-2023-4809-freebsd-pf-bypass-when-using-ipv6/


Solution
==============
The solution is to update FreeBSD to the latest version. All FreeBSD 
versions up to (but not including) 13.2-STABLE, 13.2-RELEASE-p3, 
12.4-STABLE, and 12.4-RELEASE-p5 are affected.


Best regards,
Enrico Bassetti

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.