FreeBSD up to 11.2/11.3/12.0 IPv6 m_pulldown denial of service

Summaryinfo

A vulnerability was found in FreeBSD up to 11.2/11.3/12.0. It has been declared as problematic. Affected by this vulnerability is the function m_pulldown of the component IPv6 Handler. Such manipulation leads to denial of service. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in FreeBSD up to 11.2/11.3/12.0 (Operating System). Affected by this issue is the function m_pulldown of the component IPv6 Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was presented 08/20/2019 as FreeBSD-SA-19:22.mbuf as confirmed security advisory (Website). The advisory is shared for download at freebsd.org. There are known technical details, but no exploit is available. The advisory points out:

Due do a missing check in the code of m_pulldown(9) data returned may not be contiguous as requested by the caller.

The advisory illustrates:

Extra checks in the IPv6 code catch the error condition and trigger a kernel panic leading to a remote DoS (denial-of-service) attack with certain Ethernet interfaces. At this point it is unknown if any other than the IPv6 code paths can trigger a similar condition.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability. The security advisory contains the following remark:

On systems with IPv6 active, IPv6 fragmentation may be disabled, or a firewall can be used to filter out packets with certain or excessive amounts of extension headers in a first fragment. These rules may be dependent on the operational needs of each site.

See VDB-140889 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 12.0

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion