MNBSD-2023-17: pf incorrectly handles multiple IPv6 fragment headers

Description

IPv6 fragments may bypass firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host.

Affected Versions

pf

Specific versions:

• 3.0.0
• 3.0.1
• 3.0.2
• 3.1.0

Recommendations

No specific recommendations provided.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-4809
• https://www.freebsd.org/security/advisories/FreeBSD-SA-23:10.pf.asc

Additional Information

Aliases: FreeBSD-SA-23:10.pf, CVE-2023-4809

Published: December 28, 2023
Last Modified: December 28, 2023