CVE-2023-4809 in 2.7.0-RELEASE i.e FreeBSD 14.0 ?

rainbowHash

Hello pfSense team,

i would like to ask a simple question, does anyone know if the current release 2.7.0-RELEASE FreeBSD 14.0 is affected by the vulnerability CVE-2023-4809. And if so will disabling the IPv6 stack help or not. If it is affected is there any workaround ?

i.e. here it is said only 13.2-STABLE, 13.2-RELEASE-p3, 12.4-STABLE, and 12.4-RELEASE-p5, but i can not find any information about 14.0?

NollipfSense

@rainbowHash It seems that you should have post in the General section...

rainbowHash

ok let me post in general section the same question

rcoleman-netgate

@rainbowHash said in CVE-2023-4809 in 2.7.0-RELEASE i.e FreeBSD 14.0 ?:

CVE-2023-4809

Per: https://www.reddit.com/r/PFSENSE/comments/16dm4bn/cve20234809_freebsd_pf_bypass_when_using_ipv6/

_arthur_ kp@FreeBSD.org
Note that this bypass requires rules which allow IPv6 fragments through, which is not the default in pfSense.

The vulnerability is essentially that any traffic can pretend to be IPv6 fragments.

rainbowHash

@rcoleman-netgate said in CVE-2023-4809 in 2.7.0-RELEASE i.e FreeBSD 14.0 ?:

fragments

Thank you @NollipfSense basically from your response i would say 14.0 it is affected but not per the default configuration. Can you please mentioned where can we specifically deny the IP fragments with IPv6 i.e.
under
System > Advanced, Firewall & NAT

IP Do-Not-Fragment compatibility
Firewall Maximum Fragment Entries
IP Do-Not-Fragment compatibility
IP Fragment Reassemble

System > Tunables
or maybe something under the system Tunables

under Firewall -> rules -> advanced options i see

Allow IP options

which one is related to the default configuration and what it value should be i.e. checked or unchecked ?

stephenw10

There is no specific rule to block it. All unsolicited traffic is blocked inbound by default.

Traffic is scrubbed by default which prevents fragments passing but even if you disabled that most rules would not pass fragmented traffic because they cannot match without the header info.
See: https://man.freebsd.org/cgi/man.cgi?query=pf.conf#FRAGMENT_HANDLING

There's no way to actively pass fragments from the GUI, there is no fragment option on user rules.