-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
============================================================================= FreeBSD-SA-05:13.ipfw Security Advisory The FreeBSD Project
Topic: ipfw packet matching errors with address tables
Category: core Module: netinet Announced: 2005-06-29 Credits: Max Laier Affects: FreeBSD 5.4-RELEASE Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE) 2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3) CVE Name: CAN-2005-2019
For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://www.freebsd.org/security/>.
ipfw(8) is a system facility which allows IP packet filtering, redirecting, and traffic accounting. ipfw lookup tables are a way to specify many IP addresses which can be used for packet matching in an efficient manner.
II. Problem Description
The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.
When lookup tables are used with ipfw, packets may on very rare occasions incorrectly match a lookup table. This could result in a packet being treated contrary to the defined packet filtering ruleset. For example, a packet may be allowed to pass through when it should have been discarded.
The problem can only occur on Symmetric Multi-Processor (SMP) systems, or on Uni Processor (UP) systems with the PREEMPTION kernel option enabled (not the default).
a) Do not use lookup tables.
b) Disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable:
# echo "debug.mpsafenet=0" >> /boot/loader.conf
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4 security branch dated after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.4 systems.
a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility.
b) Apply the patch.
c) Recompile your kernel as described in <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the system.
VI. Correction details
The following list contains the revision numbers of each file that was corrected in FreeBSD.
Branch Revision Path
RELENG_5 src/sys/netinet/ip_fw2.c 220.127.116.11 RELENG_5_4 src/UPDATING 1.318.104.22.168.12 src/sys/conf/newvers.sh 22.214.171.124.2.8 src/sys/netinet/ip_fw2.c 126.96.36.199.2.1
The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD)
iD8DBQFCwxeeFdaIBMps37IRAkOAAJ0cCLsoqdUsfTfPNxocl1/TSORXnwCeIq0L wM2hw6x90lSyoEVYnxfAg2s= =khtV -----END PGP SIGNATURE-----