-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-24:16.pf Errata Notice
The FreeBSD Project
Topic: Incorrect ICMPv6 state handling in pf
Category: core
Module: pf
Announced: 2024-09-19
Affects: All supported versions of FreeBSD
Corrected: 2024-09-04 08:53:34 UTC (stable/14, 14.1-STABLE)
2024-09-19 13:02:58 UTC (releng/14.1, 14.1-RELEASE-p5)
2024-09-19 13:03:30 UTC (releng/14.0, 14.0-RELEASE-p11)
2024-09-04 08:53:34 UTC (stable/13, 13.4-STABLE)
2024-09-05 07:35:39 UTC (releng/13.4, 13.4-RC3)
2024-09-19 13:04:05 UTC (releng/13.3, 13.3-RELEASE-p7)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
pf is an Internet Protocol packet filter originally written for OpenBSD. pf
uses a state table to determine whether to allow a packet that is from a
known/already open transmission. It identifies ICMPv6 states based on the
address family, protocol, addresses, and the ID.
Normally, states are created by outgoing packets, or by incoming packets
matching 'pass' rules. Packets that do not match any rule will be blocked or
allowed depending on the default rule.
ICMPv6 Neighbor Discovery has to be allowed in the firewall for IPv6 to work
properly in broadcast networks, such as Ethernet.
II. Problem Description
Patches for a previous security advisory, FreeBSD-SA-24:05, were incomplete
and introduced some overly strict pf state tracking for ICMPv6 packets.
III. Impact
The bugs may prevent ICMPv6 functions, e.g., Neighbor Discovery, from working
as designed when the pf firewall is configured.
IV. Workaround
No workaround is available but systems not using IPv6 and the pf firewall are
not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 14.1]
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-14.1.patch
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-14.1.patch.asc
# gpg --verify pf-14.1.patch.asc
[FreeBSD 14.0]
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-14.0.patch
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-14.0.patch.asc
# gpg --verify pf-14.0.patch.asc
[FreeBSD 13.4]
No discrete patch is provided against 13.4 as the fix for this issue was
incorporated into 13.4-RELEASE.
[FreeBSD 13.3]
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-13.3.patch
# fetch https://security.FreeBSD.org/patches/EN-23:16/pf-13.3.patch.asc
# gpg --verify pf-13.3.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 38f74de7184a stable/14-n268653
releng/14.1/ 1e965d5399e1 releng/14.1-n267715
releng/14.0/ 413ae023b056 releng/14.0-n265452
stable/13/ d6e5f8643d37 stable/13-n258307
releng/13.4/ e893ec49afb2 releng/13.4-n258254
releng/13.3/ ea9257bcd0e1 releng/13.3-n257467
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701>
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:05.pf.asc>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-24:16.pf.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbsPQkACgkQbljekB8A
Gu9jORAAw5niz67Jcjm2fP6//BNGgDTlXR+rI+Yajm3lNLqhz0xPZ7BDTZ/NINwc
bUfEK74R8n4kBuwhfIWendmDrYveeqGhhlZZOgiQfqXJuKmg6FBmQVQruq/Njs1Y
y1BOI/KOSyRjzB3nrq1D8HpTtj8zJdtlB3rvKbEL038BmM/AslOdQvZLq12xPyNO
xYqOYao664IaG6kqNUtN8oE8UpY0ACQGRt8BX2izLa+MAsDyglT2K3YS3cEiGRP9
ZdbKplcVTZuNZ2XIORXkatRLCgC5BnFu0bK9TO6iMPtciX0ZwKov79zAvl14TK++
sZhY2bKFEq1VrvpdngjAZfWNMTysQCZIsWqsBJCMQb42Q/DY9Cxs7KK2231zKkt2
FcKdmQro2Qiy5DIClDoZuvQitQ6hRBFaffL6yRy2Zya70gz8cok3t7iEMsB9oSr3
BVyNYBHwD3JUkq663mO785zvSIZAxQcqvuR8Tn034ffqJEojI1eFBNaHUcKvt4q4
Uea03m+zq6xwFH/ZzUow/FFxBC67Nzje+2y3gaCLt4oKPxMDmvP2N43wbHevoTPD
/p4M8fki6RFzOEjc/+vAveul23dbNmbB1ssEdkG6VcqGcesdNTygei9r7j4GGJc4
VjPmZ0emfR22lfGLGH817odQxXfb/0UYpiTuRcG1cKeU2Fv1Lg8=
=w2vT
-----END PGP SIGNATURE-----