In FreeBSD a vulnerability (CVE-2019-5611) that allows a kernel crash (packet-of-death) through specially fragmented ICMPv6 MLD packets (). The issue arises from the lack of necessary checks in the call to m_pulldown(), which can lead to the return of non-contiguous chains of mbufs, contrary to the expectations of the calling party.
Vulnerabilità in updates 12.0-RELEASE-p10, 11.3-RELEASE-p3, and 11.2-RELEASE-p14. A workaround for protection is to disable fragmentation support for IPv6 or filter options in the header at the firewall. (Hop-by-Hop). Interestingly, the bug leading to the vulnerability was identified back in 2006 and fixed in OpenBSD, NetBSD, and macOS, but remained unpatched in FreeBSD, despite the FreeBSD developers being notified of the issue.
Additionally, two more vulnerabilities have been fixed in FreeBSD:
- — overflow of the link counter for data structures in mqueuefs when using 32-bit libraries in a 64-bit environment (32-bit compat). The issue manifests when mqueuefs is enabled, which is not active by default, and may lead to access to files, directories, and sockets opened by processes belonging to other users, or facilitate access to external files from a jail environment. If the user has root access in the jail, the vulnerability allows gaining root access on the host environment.
- — an issue with multithreaded access to the device /dev/midistat during a race condition can lead to reading kernel memory areas outside the bounds allocated for the midistat buffer. On 32-bit systems, an attempt to exploit the vulnerability results in a kernel crash, while on 64-bit systems, it allows revealing the content of arbitrary kernel memory areas.
Fonte: opennet.ru
