From nobody Wed Dec 17 01:02:07 2025 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWFrH6nP9z6LVZc for ; Wed, 17 Dec 2025 01:02:07 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWFrH41Sxz3St0; Wed, 17 Dec 2025 01:02:07 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933327; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=07F9w17vJT0ezMz/KUHJ/RgVPkyTdIWnmmrNKbVvaiY=; b=EibCFco4kRlfnBnBgAAG0X9xuTyn8IOYYmamiaMDM0mMOT1P5CnUf5Xrl2akp6ANkJIu6M CXd/zfR+Pmpt40/YCr3YagZrN1G0hk/FiSrw9e+COETTGNHpiL9YoOFXtt2o2G5Tu1pYW8 sFxS/OG7pAuwO7ASn9kV+ksBxqnQ2gS9ExsUn1w3gGO9X1mzZDN09MfHFMxip2HZBn6ja5 1sJGx0wKNtCk7NJnb7jJUqEpBu0UCMrCoPw2miOA4Tl5NhRJPKKpoYFhOQA8kL+TubHrSw CRue7N8liVReVeWxXiuGEhBDBo2IfWvmWs5g6CRKRxfT6XtKeuJsqTxDqIH6+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933327; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=07F9w17vJT0ezMz/KUHJ/RgVPkyTdIWnmmrNKbVvaiY=; b=e+Hh5Q5BGfg2ske1wBg6iL+bhRtszLpn6H+spyiaX2Q91UL2/RNJrK329fp/WjfP+zpQH4 lpgwubVplmC9MKW3FKQBQlWr08Cj39R28rV2Ax7EPld13n01Y00yzw1oq0PorwJNdk39Vf +Z8kz7CyL4vteE2QQPH1o354fi0Gao/uMztX5zQglj42LxQbtFFtZMvsRcVrrUO40rmtDK 83EU9kilB3b4pwRvPdpodhgz2Foybr0t+ad/704flY2wimlBjEKSb2kJI/vLgdokLzqVaX 4SD/Ll7uvEhOpMjFjMha/mXgcFR1Vn5a8UWWtcb9WpB/hMy6Kn42qHhX6LQodA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765933327; a=rsa-sha256; cv=none; b=SSLwRkAZ0m7crCfB/90SWt4IYDZjbSG5f9l3jcgYW72MVUy2lutEhKuLpRZ1wGrD4U7sQr QvCoaFnhuFrHK7vtERS4NbkvvntSlLcRZJkJXY8QtxQGAaPSVL0CZeTCL7yRibYeNsTpeH pJpjDd0umT1SA9mY/yKxOCH8lnzHT6GRZ6fbZv/NqJ++i8mmHE8bHLe5wyJPJ8a18VsU3k X87f5KcSvpUqJX8yQIfgTrtigUAdOB3rP1ACU1tdyR6WmRsYvJsaHkRAAY7VVKJIhsDr91 KkPqfhpIRRhBECFKxkN248IafPcExjBoc3/dV11cwKs3l4H0HRqfcqOpJBasLw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: by freefall.freebsd.org (Postfix, from userid 945) id 3635EE0F7; Wed, 17 Dec 2025 01:02:07 +0000 (-00) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-25:11.ipfw Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20251217010207.3635EE0F7@freefall.freebsd.org> Date: Wed, 17 Dec 2025 01:02:07 +0000 (-00) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:11.ipfw Security Advisory The FreeBSD Project Topic: ipfw denial of service Category: core Module: ipfw Announced: 2025-12-16 Affects: FreeBSD 13 and 14 Corrected: 2025-11-04 00:52:54 UTC (stable/14, 14.3-STABLE) 2025-12-16 23:43:24 UTC (releng/14.3, 14.3-RELEASE-p7) 2025-11-04 00:52:12 UTC (stable/13, 13.5-STABLE) 2025-12-16 23:43:32 UTC (releng/13.5, 13.5-RELEASE-p8) CVE Name: CVE-2025-14769 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background ipfw(4) is one of the firewalls provided in the FreeBSD base system. Its `tcp-setmss` configuration directive allows the system administrator to lower the Maximum Segment Size of a packet. II. Problem Description In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference. III. Impact Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would allow the traffic to pass. IV. Workaround No workaround is available, but systems that do not use ipfw(4) with the `tcp-setmss` directive are not affected. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.3] # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch.asc # gpg --verify ipfw-14.patch.asc [FreeBSD 13.5] # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch.asc # gpg --verify ipfw-13.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ deb684f9d1d6 stable/14-n272799 releng/14.3/ c0cb68169beb releng/14.3-n271453 stable/13/ 94360584542a stable/13-n259534 releng/13.5/ 60026b06366f releng/13.5-n259185 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmlB+cAACgkQbljekB8A Gu9XFA//V2aCX1XCn6tCRPR51ixMJ/9rKfpWmYpGruZoB1GaKC0UvkQqDNIkXw8K r6OY1G2rK36y+AGCrxtXHnUKfDj/hzZkL4lEBr9AjcB6N4czk6q/fSuzcL0FCi9T CbWjxSEjV2M2IO4nObu8CKB/7cVY6UlIhe2d4iBH+otkzfyBsYHwCSvhDOWxeWFj f+I9ddOvCFv7lRh74RZk0CdSPe4HyptCSkwERwIn5Cm+fk7PJIFWDM4hF9atP+G8 VT3PUirG1na33vtfRw46c/Qj+L8gybq0pztkTnqsm52WME0n1go3aI7mbPmSWTwe xSC5totcYxbjQ/lMcXv00kgDzraFuPSzSzej6Z4BYXTHOgNTgHHexa3rqxs8y3i/ IoOWSDZdyd2d3B9r5xAFSzp+HVv+C9UBB/AQ0kQt0gPTX6j9d0WiMninNiedVSWf BOYCmgvI7+0ybeV54QFrVnEsImEoYu32NlLVVmswSnDOBuBcU2XtHtO7/x5BUcyU CdOiAZ78TS+007QllROCuidXiQc0FNFqgm+rRFv37Wmmm0LZVkVJ7OVB0vXuk4ps iNBFmXxHCiKL6zJGvx+OQmAXLE+xf71n9xt0jJIk/NfI1BkHYRrlYnH7JXhfBvAO SYtM+FXK1Kehj+ltLUO+9WYhkgfAUtlI/+7GKLMDzy76Q+ZMzhk= =0OhG -----END PGP SIGNATURE-----