-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-24:16.pf Errata Notice The FreeBSD Project Topic: Incorrect ICMPv6 state handling in pf Category: core Module: pf Announced: 2024-09-19 Affects: All supported versions of FreeBSD Corrected: 2024-09-04 08:53:34 UTC (stable/14, 14.1-STABLE) 2024-09-19 13:02:58 UTC (releng/14.1, 14.1-RELEASE-p5) 2024-09-19 13:03:30 UTC (releng/14.0, 14.0-RELEASE-p11) 2024-09-04 08:53:34 UTC (stable/13, 13.4-STABLE) 2024-09-05 07:35:39 UTC (releng/13.4, 13.4-RC3) 2024-09-19 13:04:05 UTC (releng/13.3, 13.3-RELEASE-p7) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background pf is an Internet Protocol packet filter originally written for OpenBSD. pf uses a state table to determine whether to allow a packet that is from a known/already open transmission. It identifies ICMPv6 states based on the address family, protocol, addresses, and the ID. Normally, states are created by outgoing packets, or by incoming packets matching 'pass' rules. Packets that do not match any rule will be blocked or allowed depending on the default rule. ICMPv6 Neighbor Discovery has to be allowed in the firewall for IPv6 to work properly in broadcast networks, such as Ethernet. II. Problem Description Patches for a previous security advisory, FreeBSD-SA-24:05, were incomplete and introduced some overly strict pf state tracking for ICMPv6 packets. III. Impact The bugs may prevent ICMPv6 functions, e.g., Neighbor Discovery, from working as designed when the pf firewall is configured. IV. Workaround No workaround is available but systems not using IPv6 and the pf firewall are not affected. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date and reboot. Perform one of the following: 1) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 2) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.1] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch.asc # gpg --verify pf-14.1.patch.asc [FreeBSD 14.0] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch.asc # gpg --verify pf-14.0.patch.asc [FreeBSD 13.4] No discrete patch is provided against 13.4 as the fix for this issue was incorporated into 13.4-RELEASE. [FreeBSD 13.3] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch.asc # gpg --verify pf-13.3.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 38f74de7184a stable/14-n268653 releng/14.1/ 1e965d5399e1 releng/14.1-n267715 releng/14.0/ 413ae023b056 releng/14.0-n265452 stable/13/ d6e5f8643d37 stable/13-n258307 releng/13.4/ e893ec49afb2 releng/13.4-n258254 releng/13.3/ ea9257bcd0e1 releng/13.3-n257467 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbsRIIACgkQbljekB8A Gu9oCxAAvkIiF5Z9qRv/7adAexBfujcrFeIR7Vfipt3KYjO21XIGZqTwNXr7pd5P lZAVqmZyhIJYU1ddzjb9NqCTBDFCbBn6AurLK7MydQDYMVG0CNBKvofZi9y0mrGf qR9HBoGN9jvGlK7pxtfS8eiV7tBGY5v2pYQdJINDCsCNT+g/gpYhotxqwFyUE1cu FFH/HHz8KT6SULG7YxxqtvojA2ra3jvb1gKKvUYm7f/f6rE2rdshxXGYAc6onqnk qlXhfJshnZOAjPq6IOvPRKv//s/rg9cQNcWpC/lKLRFPk0cYNQXjnrtRWT//8o0r CmJga6A8UGYYX0N+KfwJHLlcyyc+v7rB14NGw07gcUmvpB3F+7lGNyf7/AcEZcDD os3G752zs1O98PlGjBvlwFU7tafLfVAxGPf43YBXbEGpxeh6pHXCjoZIoEE5DD3Y TvGtvM2QrH9jRxOjTJhKLA5VPmwUNGbrrMjTZg4Z+WYuUen7GsirlpriyaJH5Bkf llHmnQrprd9kvrMMqueEtt9O2a+ljmk/BPM1j9dLelISv+WKZGAJ5jnvalZWJdnR STJjqOJm4fYq7RE13N+MT2eoZFpGw2VSV6A5M6CbdP/4Ln5GArkp0/Dow6jQ0k6L DOVfkeZfx6gsR8d9H7fA5XqxtW06QnBepUHblaKJVJTPPMTMpMU= =At7n -----END PGP SIGNATURE-----