One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.

According to its self-reported version number, the remote pfSense install is a version 2.3.x  prior or equal to  2.3.5-p2 or 2.4.x prior to 2.4.3-p1. It is, therefore, affected by multiple vulnerabilities:

 - Systems with microprocessors utilizing speculative execution and    address translations may allow unauthorized disclosure of    information residing in the L1 data cache to an attacker with    local user access via a terminal page fault and a side-channel    analysis. (CVE-2018-3620)    
 - An authenticated command injection vulnerability exists in    status_interfaces.php via dhcp_relinquish_lease() in pfSense    before 2.4.4. This allows an authenticated WebGUI user with    privileges for the affected page to execute commands in the    context of the root user when submitting a request to relinquish    a DHCP lease for an interface which is configured to obtain its    address via DHCP. (CVE-2018-16055)    
 -  a denial of service vulnerability exists in the ip fragment     reassembly code due to excessive system resource consumption.     This issue can allow a remote attacker who is able to send     arbitrary ip fragments to cause the machine to consume excessive     resources. (CVE-2018-6923)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6922 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6922 FreeBSD is vulnerable to a denial of service, caused by the use of an inefficient TCP reassembly algorithm. By sending specially-crafted TCP traffic, a remote attacker could exploit this vulnerability to consume all available CPU resources.

One of the data structures that holds TCP segments uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. Impact : An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.

ID	Name	Product	Family	Severity
119887	pfSense 2.3.x <= 2.3.5-p2 / 2.4.x < 2.4.4 Multiple Vulnerabilities (SA-18_06 / SA-18_07 / SA-18_08)	Nessus	Firewalls	high
118831	AIX 7.2 TL 3 : freebsd (IJ09625)	Nessus	AIX Local Security Checks	medium
118830	AIX 7.2 TL 2 : freebsd (IJ09624)	Nessus	AIX Local Security Checks	medium
118829	AIX 7.2 TL 1 : freebsd (IJ09623)	Nessus	AIX Local Security Checks	medium
118828	AIX 7.2 TL 0 : freebsd (IJ09622)	Nessus	AIX Local Security Checks	medium
118827	AIX 7.1 TL 5 : freebsd (IJ09621)	Nessus	AIX Local Security Checks	medium
118826	AIX 7.1 TL 4 : freebsd (IJ09620)	Nessus	AIX Local Security Checks	medium
118825	AIX 6.1 TL 9 : freebsd (IJ09619)	Nessus	AIX Local Security Checks	medium
118824	AIX 5.3 TL 12 : freebsd (IJ09618)	Nessus	AIX Local Security Checks	medium
111561	FreeBSD : FreeBSD -- Resource exhaustion in TCP reassembly (3c2eea8c-99bf-11e8-8bee-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-6922

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium