FreeBSD3D02520D-B309-11E9-A87F-A4BADB2F4699FreeBSD -- IPv6 fragment reassembly panic in pf(4)
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
0.136 Low
EPSS
Percentile
95.6%
Problem Description:
A bug in the pf(4) IPv6 fragment reassembly logic
incorrectly uses the last extension header offset from the
last received packet instead of from the first packet.
Impact:
Malicious IPv6 packets with different IPv6 extensions
could cause a kernel panic or potentially a filtering rule
bypass.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| FreeBSD | any | noarch | freebsd-kernel | = 12.0 | UNKNOWN |
| FreeBSD | any | noarch | freebsd-kernel | < 12.0_4 | UNKNOWN |
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
0.136 Low
EPSS
Percentile
95.6%