CVE-2023-4809

Published Sep 6, 2023

Last updated a year ago

CVSS high 7.5

Overview

Description: In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host.
Source: secteam@freebsd.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-Other
secteam@freebsd.org: CWE-167

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7F6C8B0-9D75-476C-ADBA-754416FBC186",
            "versionEndExcluding": "12.4"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BA49E374-9F1A-4F62-B88D-CD36EDEA6060",
            "versionEndExcluding": "13.2",
            "versionStartIncluding": "13.0"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24920B4D-96C0-401F-B679-BEB086760EAF"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3CE32730-A9F5-4E8D-BDA4-6B8232F84787"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "552E81DE-D409-475F-8ED0-E10A0BE43D29"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "251CAE22-C3E6-45AD-8301-F36BEE5C6860"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "85D94BCA-FA32-4C10-95CD-5D2A69B38A7A"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BA821886-B26B-47A6-ABC9-B8F70CE0ACFB"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:rc2-p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "220629AD-32CC-4303-86AE-1DD27F0E4C65"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A87EFA20-DD6B-41C5-98FD-A29F67D2E732"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2888B0C1-4D85-42EC-9696-03FAD0A9C28F"
          },
          {
            "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3306F11-D3C0-41D6-BB5E-2ABDC3927715"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References