From nobody Thu Sep 19 15:48:26 2024 X-Original-To: freebsd-announce@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4X8g0V2LfPz5X8ds for ; Thu, 19 Sep 2024 15:48:26 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [96.47.72.132]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4X8g0V1dj2z4Q2V; Thu, 19 Sep 2024 15:48:26 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726760906; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=XpAYskkZQr3d3N+TXheh8QCn0wDQQ9K41C9Dqu4J06Y=; b=g84QQBXBDp+L07BYVhzdlHjjOVsl5uSx3pjt5L1azUJqFGcp/OULKWC9YWx7gLdhlck+Uq N42Lb2LLDyiVxHkFzwvII9or99w8/uGKEhhvygS7K/etEhjMWl8MZTbukGu7KDy311BMDO etWuaLhI2IgwMpOYTdGe/lAXnI1wXr7OCv84L9xS/O2/CXZOnVsgtv9Z3Fvam1TTJRzjnW VFxS9XJs0G5LMYYkbSzhEG/QGFqVbzGlhlQovN+iM7XL9mn1y8hmPe/LfLpQXfgmlsH2+N Ps5u2O0Byu4qSmTNHOzDNi708IHpJlmzxMIRiaU/QR0dsqoRMDYHZg3sEdXCWg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1726760906; a=rsa-sha256; cv=none; b=TkbTBMLGl9zw6CTjIfqUm3VhPoXhzpjJuUle7LONPUjII5swMKFebGOry8qBYxFUwUE6ke LMncMKCT3CBflYsEQefOdR8P9S/8/qZCbCHM/ieqi3M8EFjLJVBeKKDrt7i5BIUtOKBLEW m0fPkZiOmKsqu5X6cZglDd0zm2WuDuvjqUJafEdQP2YCW08ha4S2EBrxZUp0ni7nPQeSRh KHJgoRcQ5ro4FNC9JBDK6VnNVC3ydt7xyX8hFiv6w+n3I8MU+9FpYVo38Ye3uiBD5wybGY nhkjuIi9JAlwOdg1JD94MP+Ck/VuoTWKgnK+diB5cEpUP5db/QLr1vlfMuhENA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726760906; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=XpAYskkZQr3d3N+TXheh8QCn0wDQQ9K41C9Dqu4J06Y=; b=OO9uVuTsS5kOqiFrTp2tbuiqk71/rBKZxaCajkpvREPBO/QYg2jMe3Cc73Ptdtc1GPojES XbE/SQJEsQ6ABLX6MtZqAnSO0ELgumE7XHylkedTsx019uKScDn0+SbgxcFX+GPNaCD+RQ VA5SQojXTFBNyo6v8RFAOzHwWT2nuD3JXtLKmPx5vjQpH3Gh1SdrF/isVDN+g9xFO+7+WR bt1IDL381Rfp5w8ITUcDj4xxbExvXmVGhbL9tCXSrYtuJvOd0aEVp7SHiUJHiCaEtrso+C czfs8frtsKvCeUOdbgkFy4lBeG/P92S9jvq9ZNlbd7mcaj7wWXNAtkzddYH/ag== Received: by freefall.freebsd.org (Postfix, from userid 945) id 1A3591C50A; Thu, 19 Sep 2024 15:48:26 +0000 (UTC) From: FreeBSD Errata Notices To: FreeBSD Errata Notices Subject: FreeBSD Errata Notice FreeBSD-EN-24:16.pf Reply-To: freebsd-stable@freebsd.org Precedence: bulk Message-Id: <20240919154826.1A3591C50A@freefall.freebsd.org> Date: Thu, 19 Sep 2024 15:48:26 +0000 (UTC) List-Id: Project Announcements [moderated] List-Archive: https://lists.freebsd.org/archives/freebsd-announce List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-announce@freebsd.org Sender: owner-freebsd-announce@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-24:16.pf Errata Notice The FreeBSD Project Topic: Incorrect ICMPv6 state handling in pf Category: core Module: pf Announced: 2024-09-19 Affects: All supported versions of FreeBSD Corrected: 2024-09-04 08:53:34 UTC (stable/14, 14.1-STABLE) 2024-09-19 13:02:58 UTC (releng/14.1, 14.1-RELEASE-p5) 2024-09-19 13:03:30 UTC (releng/14.0, 14.0-RELEASE-p11) 2024-09-04 08:53:34 UTC (stable/13, 13.4-STABLE) 2024-09-05 07:35:39 UTC (releng/13.4, 13.4-RC3) 2024-09-19 13:04:05 UTC (releng/13.3, 13.3-RELEASE-p7) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background pf is an Internet Protocol packet filter originally written for OpenBSD. pf uses a state table to determine whether to allow a packet that is from a known/already open transmission. It identifies ICMPv6 states based on the address family, protocol, addresses, and the ID. Normally, states are created by outgoing packets, or by incoming packets matching 'pass' rules. Packets that do not match any rule will be blocked or allowed depending on the default rule. ICMPv6 Neighbor Discovery has to be allowed in the firewall for IPv6 to work properly in broadcast networks, such as Ethernet. II. Problem Description Patches for a previous security advisory, FreeBSD-SA-24:05, were incomplete and introduced some overly strict pf state tracking for ICMPv6 packets. III. Impact The bugs may prevent ICMPv6 functions, e.g., Neighbor Discovery, from working as designed when the pf firewall is configured. IV. Workaround No workaround is available but systems not using IPv6 and the pf firewall are not affected. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date and reboot. Perform one of the following: 1) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 2) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.1] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.1.patch.asc # gpg --verify pf-14.1.patch.asc [FreeBSD 14.0] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-14.0.patch.asc # gpg --verify pf-14.0.patch.asc [FreeBSD 13.4] No discrete patch is provided against 13.4 as the fix for this issue was incorporated into 13.4-RELEASE. [FreeBSD 13.3] # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch # fetch https://security.FreeBSD.org/patches/EN-24:16/pf-13.3.patch.asc # gpg --verify pf-13.3.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 38f74de7184a stable/14-n268653 releng/14.1/ 1e965d5399e1 releng/14.1-n267715 releng/14.0/ 413ae023b056 releng/14.0-n265452 stable/13/ d6e5f8643d37 stable/13-n258307 releng/13.4/ e893ec49afb2 releng/13.4-n258254 releng/13.3/ ea9257bcd0e1 releng/13.3-n257467 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbsRIIACgkQbljekB8A Gu9oCxAAvkIiF5Z9qRv/7adAexBfujcrFeIR7Vfipt3KYjO21XIGZqTwNXr7pd5P lZAVqmZyhIJYU1ddzjb9NqCTBDFCbBn6AurLK7MydQDYMVG0CNBKvofZi9y0mrGf qR9HBoGN9jvGlK7pxtfS8eiV7tBGY5v2pYQdJINDCsCNT+g/gpYhotxqwFyUE1cu FFH/HHz8KT6SULG7YxxqtvojA2ra3jvb1gKKvUYm7f/f6rE2rdshxXGYAc6onqnk qlXhfJshnZOAjPq6IOvPRKv//s/rg9cQNcWpC/lKLRFPk0cYNQXjnrtRWT//8o0r CmJga6A8UGYYX0N+KfwJHLlcyyc+v7rB14NGw07gcUmvpB3F+7lGNyf7/AcEZcDD os3G752zs1O98PlGjBvlwFU7tafLfVAxGPf43YBXbEGpxeh6pHXCjoZIoEE5DD3Y TvGtvM2QrH9jRxOjTJhKLA5VPmwUNGbrrMjTZg4Z+WYuUen7GsirlpriyaJH5Bkf llHmnQrprd9kvrMMqueEtt9O2a+ljmk/BPM1j9dLelISv+WKZGAJ5jnvalZWJdnR STJjqOJm4fYq7RE13N+MT2eoZFpGw2VSV6A5M6CbdP/4Ln5GArkp0/Dow6jQ0k6L DOVfkeZfx6gsR8d9H7fA5XqxtW06QnBepUHblaKJVJTPPMTMpMU= =At7n -----END PGP SIGNATURE-----