[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZPucT1zmygLfWnPR@t430s.bluhm.invalid>
Date: Sat, 9 Sep 2023 00:12:31 +0200
From: Alexander Bluhm <alexander.bluhm@....net>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2023-4809: FreeBSD pf bypass when using IPv6
On Fri, Sep 08, 2023 at 07:48:21PM +0200, Enrico Bassetti wrote:
> A FreeBSD with `pf` as firewall for IPv6 traffic and `scrub` enabled to
> reassemble IPv6 fragments is vulnerable to an attack that uses a crafted
> packet posing as IPv6 "atomic" fragment to bypass the rules.
I would like to mention that OpenBSD pf is not affected by the bug.
As I am the original author of IPv6 fragment reassembly, I have
just added a regression test to show that our pf drops such packets.
https://cvsweb.openbsd.org/src/regress/sys/netinet6/frag6/frag6_doubleatomic.py
This behavior seems to be present since 2013 when I added support
for atomic fragments to pf. The relevant code is in OpenBSD
pf_walk_header6() in pf.c. There a bunch of sanity checks are done
for the IPv6 header chain resulting in packet drops. This function
does not exist in FreeBSD.
https://github.com/openbsd/src/blame/cc53a24ce58eb2212822060db742650de2787ee4/sys/net/pf.c#L7076
bluhm
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
