CVE-2024-6640 pf incorrectly matches different ICMPv6 states in the state table

In ICMPv6 Neighbor Discovery ND, the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation NS can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to...

CVE-2024-6640

The pf firewall on FreeBSD incorrectly matches different ICMPv6 states in the state table. In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND but block incoming Echo Requests, a crafted Echo Request packet sent from the same host as a Neighbor Solicitation (N...