In FreeBSD vulnerability (CVE-2019-5611) that allows a kernel crash (packet-of-death) by sending specially fragmented ICMPv6 MLD packets (). The issue the lack of necessary checks in the m_pulldown() call, which can result in the return of non-contiguous mbuf chains, contrary to the expectations of the caller.
Kwetsbaarheid in updates 12.0-RELEASE-p10, 11.3-RELEASE-p3 and 11.2-RELEASE-p14. As a workaround, fragmentation support for IPv6 can be disabled or options in the header can be filtered at the firewall. (Hop-by-Hop). Interestingly, the vulnerability-causing bug was discovered back in 2006 and patched in OpenBSD, NetBSD, and macOS, but it remained unaddressed in FreeBSD, despite the FreeBSD developers being notified about the problem.
It is also worth noting the resolution of two additional vulnerabilities in FreeBSD:
- ā a reference count overflow in data structures in mqueuefs when using 32-bit libraries in a 64-bit environment (32-bit compat). The issue manifests when mqueuefs is enabled, which is not active by default, and may lead to access to files, directories, and sockets open by processes belonging to other users, or to facilitate access to external files from jail environments. With root access in jail, the vulnerability allows for gaining root access on the host environment.
- ā a problem with multithreaded access to the device /dev/midistat under race conditions may lead to reading kernel memory areas outside the bounds allocated for the midistat buffer. On 32-bit systems, attempting to exploit the vulnerability results in a kernel crash, while on 64-bit systems, it allows reading arbitrary kernel memory areas.
Bron: opennet.ru
