FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Remote kernel panics on IPv6 connections

Affected systems
6.3 < FreeBSD < 6.3_4
7.0 < FreeBSD < 7.0_4

Details

VuXML ID 2f794295-7b69-11dd-80ba-000bcdf0a03b
Discovery 2008-09-03
Entry 2008-09-05

Problem Description:

In case of an incoming ICMPv6 'Packet Too Big Message', there is an insufficient check on the proposed new MTU for a path to the destination.

Impact:

When the kernel is configured to process IPv6 packets and has active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet Too Big Message' could cause the TCP stack of the kernel to panic.

Workaround:

Systems without INET6 / IPv6 support are not vulnerable and neither are systems which do not listen on any IPv6 TCP sockets and have no active IPv6 connections.

Filter ICMPv6 'Packet Too Big Messages' using a firewall, but this will at the same time break PMTU support for IPv6 connections.

References

CVE Name CVE-2008-3530
FreeBSD Advisory SA-08:09.icmp6