FreeBSD Security Advisory FreeBSD-SA-05:13.ipfw

2005-06-30T00:00:00
ID SECURITYVULNS:DOC:9006
Type securityvulns
Reporter Securityvulns
Modified 2005-06-30T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

============================================================================= FreeBSD-SA-05:13.ipfw Security Advisory The FreeBSD Project

Topic: ipfw packet matching errors with address tables

Category: core Module: netinet Announced: 2005-06-29 Credits: Max Laier Affects: FreeBSD 5.4-RELEASE Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE) 2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3) CVE Name: CAN-2005-2019

For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://www.freebsd.org/security/>.

I. Background

ipfw(8) is a system facility which allows IP packet filtering, redirecting, and traffic accounting. ipfw lookup tables are a way to specify many IP addresses which can be used for packet matching in an efficient manner.

II. Problem Description

The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.

III. Impact

When lookup tables are used with ipfw, packets may on very rare occasions incorrectly match a lookup table. This could result in a packet being treated contrary to the defined packet filtering ruleset. For example, a packet may be allowed to pass through when it should have been discarded.

The problem can only occur on Symmetric Multi-Processor (SMP) systems, or on Uni Processor (UP) systems with the PREEMPTION kernel option enabled (not the default).

IV. Workaround

a) Do not use lookup tables.

OR

b) Disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable:

# echo "debug.mpsafenet=0" >> /boot/loader.conf

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4 security branch dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.4 systems.

a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility.

fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch

fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch.asc

b) Apply the patch.

cd /usr/src

patch < /path/to/patch

c) Recompile your kernel as described in <URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the system.

VI. Correction details

The following list contains the revision numbers of each file that was corrected in FreeBSD.

Branch Revision Path


RELENG_5 src/sys/netinet/ip_fw2.c 1.70.2.14 RELENG_5_4 src/UPDATING 1.342.2.24.2.12 src/sys/conf/newvers.sh 1.62.2.18.2.8 src/sys/netinet/ip_fw2.c 1.70.2.10.2.1


VII. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2019

The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD)

iD8DBQFCwxeeFdaIBMps37IRAkOAAJ0cCLsoqdUsfTfPNxocl1/TSORXnwCeIq0L wM2hw6x90lSyoEVYnxfAg2s= =khtV -----END PGP SIGNATURE-----