Input validation error in FreeBSD

1) Input validation error

EUVDB-ID: #VU35901

Risk: High

CVSSv4.0: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-5597

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of the first packet allowing maliciously crafted IPv6 packets to cause a crash or potentially bypass the packet filter.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FreeBSD: 11.2 - 12.0

CPE2.3

• cpe:2.3:o:freebsd_foundation:freebsd:11.2:*:*:*:*:*:*:*
• cpe:2.3:o:freebsd_foundation:freebsd:12.0:*:*:*:*:*:*:*

External links

https://packetstormsecurity.com/files/152933/FreeBSD-Security-Advisory-FreeBSD-SA-19-05.pf.html
https://www.securityfocus.com/bid/108395
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:05.pf.asc
https://security.netapp.com/advisory/ntap-20190611-0001/
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.