Date: Thu, 19 Sep 2024 15:48:26 +0000 (UTC) From: FreeBSD Errata Notices <errata-notices@freebsd.org> To: FreeBSD Errata Notices <errata-notices@freebsd.org> Subject: FreeBSD Errata Notice FreeBSD-EN-24:16.pf Message-ID: <20240919154826.1A3591C50A@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-24:16.pf Errata Notice
The FreeBSD Project
Topic: Incorrect ICMPv6 state handling in pf
Category: core
Module: pf
Announced: 2024-09-19
Affects: All supported versions of FreeBSD
Corrected: 2024-09-04 08:53:34 UTC (stable/14, 14.1-STABLE)
2024-09-19 13:02:58 UTC (releng/14.1, 14.1-RELEASE-p5)
2024-09-19 13:03:30 UTC (releng/14.0, 14.0-RELEASE-p11)
2024-09-04 08:53:34 UTC (stable/13, 13.4-STABLE)
2024-09-05 07:35:39 UTC (releng/13.4, 13.4-RC3)
2024-09-19 13:04:05 UTC (releng/13.3, 13.3-RELEASE-p7)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
pf is an Internet Protocol packet filter originally written for OpenBSD. pf
uses a state table to determine whether to allow a packet that is from a
known/already open transmission. It identifies ICMPv6 states based on the
address family, protocol, addresses, and the ID.
Normally, states are created by outgoing packets, or by incoming packets
matching 'pass' rules. Packets that do not match any rule will be blocked or
allowed depending on the default rule.
ICMPv6 Neighbor Discovery has to be allowed in the firewall for IPv6 to work
properly in broadcast networks, such as Ethernet.
II. Problem Description
Patches for a previous security advisory, FreeBSD-SA-24:05, were incomplete
and introduced some overly strict pf state tracking for ICMPv6 packets.
III. Impact
The bugs may prevent ICMPv6 functions, e.g., Neighbor Discovery, from working
as designed when the pf firewall is configured.
IV. Workaround
No workaround is available but systems not using IPv6 and the pf firewall are
not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 14.1]
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch.asc
# gpg --verify pf-14.1.patch.asc
[FreeBSD 14.0]
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch.asc
# gpg --verify pf-14.0.patch.asc
[FreeBSD 13.4]
No discrete patch is provided against 13.4 as the fix for this issue was
incorporated into 13.4-RELEASE.
[FreeBSD 13.3]
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch
# fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch.asc
# gpg --verify pf-13.3.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 38f74de7184a stable/14-n268653
releng/14.1/ 1e965d5399e1 releng/14.1-n267715
releng/14.0/ 413ae023b056 releng/14.0-n265452
stable/13/ d6e5f8643d37 stable/13-n258307
releng/13.4/ e893ec49afb2 releng/13.4-n258254
releng/13.3/ ea9257bcd0e1 releng/13.3-n257467
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>;
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701>;
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:05.pf.asc>;
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-24:16.pf.asc>;
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbsRIIACgkQbljekB8A
Gu9oCxAAvkIiF5Z9qRv/7adAexBfujcrFeIR7Vfipt3KYjO21XIGZqTwNXr7pd5P
lZAVqmZyhIJYU1ddzjb9NqCTBDFCbBn6AurLK7MydQDYMVG0CNBKvofZi9y0mrGf
qR9HBoGN9jvGlK7pxtfS8eiV7tBGY5v2pYQdJINDCsCNT+g/gpYhotxqwFyUE1cu
FFH/HHz8KT6SULG7YxxqtvojA2ra3jvb1gKKvUYm7f/f6rE2rdshxXGYAc6onqnk
qlXhfJshnZOAjPq6IOvPRKv//s/rg9cQNcWpC/lKLRFPk0cYNQXjnrtRWT//8o0r
CmJga6A8UGYYX0N+KfwJHLlcyyc+v7rB14NGw07gcUmvpB3F+7lGNyf7/AcEZcDD
os3G752zs1O98PlGjBvlwFU7tafLfVAxGPf43YBXbEGpxeh6pHXCjoZIoEE5DD3Y
TvGtvM2QrH9jRxOjTJhKLA5VPmwUNGbrrMjTZg4Z+WYuUen7GsirlpriyaJH5Bkf
llHmnQrprd9kvrMMqueEtt9O2a+ljmk/BPM1j9dLelISv+WKZGAJ5jnvalZWJdnR
STJjqOJm4fYq7RE13N+MT2eoZFpGw2VSV6A5M6CbdP/4Ln5GArkp0/Dow6jQ0k6L
DOVfkeZfx6gsR8d9H7fA5XqxtW06QnBepUHblaKJVJTPPMTMpMU=
=At7n
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20240919154826.1A3591C50A>