FreeBSD Security Advisory FreeBSD-SA-14:08.tcp

[Ronald F. Guilmette]

In message <53629582.9010605 at delphij.net>, Xin Li <delphij at delphij.net> wrote:
>On 05/01/14 07:19, Karl Pielorz wrote:
>> 
>> 
>> --On 30 April 2014 04:35:10 +0000 FreeBSD Security Advisories 
>> <security-advisories at freebsd.org> wrote:
>> 
>>> II.  Problem Description
>>> 
>>> FreeBSD may add a reassemble queue entry on the stack into the
>>> segment list when the reassembly queue reaches its limit.  The
>>> memory from the stack is undefined after the function returns.
>>> Subsequent iterations of the reassembly function will attempt to
>>> access this entry.
>> 
>> Hi,
>> 
>> Does this require an established TCP session to be present? - i.e.
>> If you have a host which provides no external TCP sessions (i.e.
>> replies 'Connection Refused' / drops the initial SYN) would that
>> still be potentially exploitable?
>
>No.  An established TCP session is required.

I also have a question....

If one manages a system where (a) all local user accounts are completely
and 100% trustworthy and where (b) one has in place ipfw rules which reject
all incoming packet *fragments* on all outward-facing interfaces, then is
this security problem (relating to the reassembly queue) an issue at all
for said system?  Or is it rather a non-event in such contexts?


Regards,
rfg