In FreeBSD A vulnerability (CVE-2019-5611) allowing a kernel crash (packet-of-death) through the sending of specially fragmented ICMPv6 MLD packets (). The issue is due to a lack of necessary checks in the m_pulldown() call, which can lead to returning non-continuous chains of mbufs, contrary to the expectations of the caller.
The vulnerability In updates 12.0-RELEASE-p10, 11.3-RELEASE-p3, and 11.2-RELEASE-p14. As a workaround for protection, IPv6 fragmentation support can be disabled or options in the header can be filtered at the firewall. (Hop-by-Hop). Interestingly, the bug leading to the vulnerability was identified back in 2006 and fixed in OpenBSD, NetBSD, and macOS, but remained uncorrected in FreeBSD, despite the FreeBSD developers being notified of the issue.
It is also noteworthy that FreeBSD has addressed two more vulnerabilities:
- — a reference count overflow in data structures in mqueuefs when using 32-bit libraries in a 64-bit environment (32-bit compat). The issue arises when mqueuefs is enabled, which is not active by default, and could allow access to files, directories, and sockets opened by processes belonging to other users, or facilitate access to external files from a jail environment. When a user has root access in the jail, the vulnerability allows gaining root access in the host environment.
- — a problem with multithreaded access to the device /dev/midistat in the event of a race condition may lead to reading kernel memory areas outside the bounds allocated for the midistat buffer. On 32-bit systems, attempting to exploit the vulnerability results in a kernel crash, while on 64-bit systems, it allows determining the contents of arbitrary kernel memory areas.
Source: opennet.ru
