Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 9 Sep 2023 00:12:31 +0200
From: Alexander Bluhm <>
Subject: Re: CVE-2023-4809: FreeBSD pf bypass when using IPv6

On Fri, Sep 08, 2023 at 07:48:21PM +0200, Enrico Bassetti wrote:
> A FreeBSD with `pf` as firewall for IPv6 traffic and `scrub` enabled to 
> reassemble IPv6 fragments is vulnerable to an attack that uses a crafted 
> packet posing as IPv6 "atomic" fragment to bypass the rules.

I would like to mention that OpenBSD pf is not affected by the bug.
As I am the original author of IPv6 fragment reassembly, I have
just added a regression test to show that our pf drops such packets.

This behavior seems to be present since 2013 when I added support
for atomic fragments to pf.  The relevant code is in OpenBSD
pf_walk_header6() in pf.c.  There a bunch of sanity checks are done
for the IPv6 header chain resulting in packet drops.  This function
does not exist in FreeBSD.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.