In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is.
As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/09/08/5 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2023/09/08/6 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2023/09/08/7 | Mailing List Third Party Advisory |
| https://security.FreeBSD.org/advisories/FreeBSD-SA-23:10.pf.asc | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20231221-0009/ | |
| http://www.openwall.com/lists/oss-security/2023/09/08/5 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2023/09/08/6 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2023/09/08/7 | Mailing List Third Party Advisory |
| https://security.FreeBSD.org/advisories/FreeBSD-SA-23:10.pf.asc | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20231221-0009/ |
Configurations
Configuration 1 (hide)
|
History
13 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host. |
21 Nov 2024, 08:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2023/09/08/5 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2023/09/08/6 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2023/09/08/7 - Mailing List, Third Party Advisory | |
| References | () https://security.FreeBSD.org/advisories/FreeBSD-SA-23:10.pf.asc - Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20231221-0009/ - |
21 Dec 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Sep 2023, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:rc2-p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:12.4:p1:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/09/08/6 - Mailing List, Third Party Advisory | |
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/09/08/7 - Mailing List, Third Party Advisory | |
| References | (MISC) https://security.FreeBSD.org/advisories/FreeBSD-SA-23:10.pf.asc - Vendor Advisory | |
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/09/08/5 - Mailing List, Third Party Advisory | |
| First Time |
Freebsd freebsd
Freebsd |
09 Sep 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Sep 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Sep 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-06 20:15
Updated : 2025-02-13 18:15
NVD link : CVE-2023-4809
Mitre link : CVE-2023-4809
CVE.ORG link : CVE-2023-4809
JSON object : View
Products Affected
freebsd
- freebsd
CWE