FreeBSD Security Advisory FreeBSD-SA-05:13.ipfw

From: FreeBSD Security Advisories (security-advisories_at_freebsd.org)
Date: 06/29/05

  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-05:14.bzip2" 
    Date: Wed, 29 Jun 2005 21:54:53 GMT
To: FreeBSD Security Advisories <security-advisories@freebsd.org>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    =============================================================================
    FreeBSD-SA-05:13.ipfw Security Advisory
                                                              The FreeBSD Project

    Topic: ipfw packet matching errors with address tables

    Category: core
    Module: netinet
    Announced: 2005-06-29
    Credits: Max Laier
    Affects: FreeBSD 5.4-RELEASE
    Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE)
                    2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3)
    CVE Name: CAN-2005-2019

    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the
    following sections, please visit
    <URL:http://www.freebsd.org/security/>.

    I. Background

    ipfw(8) is a system facility which allows IP packet filtering,
    redirecting, and traffic accounting. ipfw lookup tables are a way to
    specify many IP addresses which can be used for packet matching in an
    efficient manner.

    II. Problem Description

    The ipfw tables lookup code caches the result of the last query. The
    kernel may process multiple packets concurrently, performing several
    concurrent table lookups. Due to an insufficient locking, a cached
    result can become corrupted that could cause some addresses to be
    incorrectly matched against a lookup table.

    III. Impact

    When lookup tables are used with ipfw, packets may on very rare
    occasions incorrectly match a lookup table. This could result in a
    packet being treated contrary to the defined packet filtering ruleset.
    For example, a packet may be allowed to pass through when it should
    have been discarded.

    The problem can only occur on Symmetric Multi-Processor (SMP) systems,
    or on Uni Processor (UP) systems with the PREEMPTION kernel option
    enabled (not the default).

    IV. Workaround

    a) Do not use lookup tables.

    OR

    b) Disable concurrent processing of packets in the network stack by
       setting the "debug.mpsafenet=0" tunable:

       # echo "debug.mpsafenet=0" >> /boot/loader.conf

    V. Solution

    Perform one of the following:

    1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4
    security branch dated after the correction date.

    2) To patch your present system:

    The following patches have been verified to apply to FreeBSD 5.4
    systems.

    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.

    # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch
    # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch.asc

    b) Apply the patch.

    # cd /usr/src
    # patch < /path/to/patch

    c) Recompile your kernel as described in
    <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
    system.

    VI. Correction details

    The following list contains the revision numbers of each file that was
    corrected in FreeBSD.

    Branch Revision
      Path
    - -------------------------------------------------------------------------
    RELENG_5
      src/sys/netinet/ip_fw2.c 1.70.2.14
    RELENG_5_4
      src/UPDATING 1.342.2.24.2.12
      src/sys/conf/newvers.sh 1.62.2.18.2.8
      src/sys/netinet/ip_fw2.c 1.70.2.10.2.1
    - -------------------------------------------------------------------------

    VII. References

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2019

    The latest revision of this advisory is available at
    ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (FreeBSD)

    iD8DBQFCwxeeFdaIBMps37IRAkOAAJ0cCLsoqdUsfTfPNxocl1/TSORXnwCeIq0L
    wM2hw6x90lSyoEVYnxfAg2s=
    =khtV
    -----END PGP SIGNATURE-----
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-05:14.bzip2"