FreeBSD < 10.3-RELEASE-p19 / 11.0 < 11.0-RELEASE-p10 ipfilter Kernel Module Packet Fragment DoS (FreeBSD-SA-17:04.ipfilter)

High Nessus Plugin ID 99994

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The version of the FreeBSD kernel running on the remote host is prior to 10.3-RELEASE-p19 or 11.0 prior to 11.0-RELEASE-p10. It, therefore, affected by a use-after-free error in the ipfilter kernel module (ipl.ko) due to freeing the wrong entry in a hash table when matching packet fragments are processed. An unauthenticated, remote attacker can exploit this issue, via specially crafted packet fragments, to cause a panic and reboot, resulting in a denial of service condition.

Note that this issue only affects hosts with ipfilter enabled and the 'keep state' or 'keep frags' rule options enabled.

Solution

Upgrade to FreeBSD version 10.3-RELEASE-p19 / 11.0-RELEASE-p10 or later. Alternatively, apply the patch referenced in the advisory.

See Also

http://www.nessus.org/u?e471fb57

Plugin Details

Severity: High

ID: 99994

File Name: freebsd_sa-17-04_ipfilter.nasl

Version: 1.8

Type: local

Published: 2017/05/05

Updated: 2018/12/07

Dependencies: 12634

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

CVSS Score Source: CVE-2017-1081

CVSS v2.0

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info, Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2017/04/27

Vulnerability Publication Date: 2017/04/27

Reference Information

CVE: CVE-2017-1081

BID: 98089