FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- ipfilter(4) fragment handling panic

Affected packages
11.0 <= FreeBSD-kernel < 11.0_10
10.3 <= FreeBSD-kernel < 10.3_19

Details

VuXML ID 51d1282d-420e-11e7-82c5-14dae9d210b8
Discovery 2017-04-27
Entry 2017-05-26

Problem Description:

ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed).

Impact:

Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.

References

CVE Name CVE-2017-1081
FreeBSD Advisory SA-17:04.ipfilter