160 lines
6.2 KiB
Text
160 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-18:01.ipsec [REVISED] Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: ipsec validation and use-after-free
|
|
|
|
Category: core
|
|
Module: ipsec
|
|
Announced: 2018-03-07
|
|
Credits: Maxime Villard
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2018-02-24 13:04:02 UTC (stable/11, 11.1-STABLE)
|
|
2018-03-07 05:53:35 UTC (releng/11.1, 11.1-RELEASE-p7)
|
|
2018-03-07 16:55:15 UTC (stable/10, 10.4-STABLE)
|
|
2018-03-07 17:16:41 UTC (releng/10.4, 10.4-RELEASE-p7)
|
|
2018-03-07 17:16:41 UTC (releng/10.3, 10.3-RELEASE-p28)
|
|
CVE Name: CVE-2018-6916
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
0. Revision History
|
|
|
|
v1.0 2018-03-07 Initial release.
|
|
v1.1 2018-03-08 Correct patch for 10.x releases.
|
|
|
|
I. Background
|
|
|
|
The IPsec suite of protocols provide network level security for IPv4 and IPv6
|
|
packets. FreeBSD includes software originally developed by the KAME project
|
|
which implements the various protocols that make up IPsec.
|
|
|
|
In IPsec, the IP Authentication Header (AH) is used to provide protection
|
|
against replay attacks and connectionless integrity and data origin
|
|
authentication for IP datagrams.
|
|
|
|
II. Problem Description
|
|
|
|
Due to a lack of strict checking, an attacker from a trusted host can
|
|
send a specially constructed IP packet that may lead to a system crash.
|
|
|
|
Additionally, a use-after-free vulnerability in the AH handling code could
|
|
cause unpredictable results.
|
|
|
|
III. Impact
|
|
|
|
Access to out of bounds or freed mbuf data can lead to a kernel panic or
|
|
other unpredictable results.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems not using IPsec are not vulnerable.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
And reboot the system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
And reboot the system
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
[*** v1.1 NOTE ***] If your 10.x sources were already patched using the
|
|
initially published advisory patches, you need to apply the
|
|
ipsec-10.rev1.patch. If you had not yet patched your 10.x sources, you need
|
|
only apply the ipsec-10.patch file. 11.1 sources were correct in the initial
|
|
release and do not need to be updated.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 10.x system not patched with the original SA-18:01 patch]
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.patch.asc
|
|
# gpg --verify ipsec-10.patch.asc
|
|
|
|
[FreeBSD 10.x that had been patched with the original SA-18:01 patch]
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.rev1.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.rev1.patch.asc
|
|
# gpg --verify ipsec-10.rev1.patch.asc
|
|
|
|
[FreeBSD 11.1]
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-11.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-11.patch.asc
|
|
# gpg --verify ipsec-11.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/10/ r330609
|
|
releng/10.3/ r330611
|
|
releng/10.4/ r330611
|
|
stable/11/ r329907
|
|
releng/11.1/ r330566
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6916>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:01.ipsec.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlqg1K9fFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cJCDQ/+OpTS1PrKiwuRsJ5i0RWnS8C9d/dIn9C83JJtuxhGb+CEY5bYSVKufsW/
|
|
ilkUK3fiOWWwDHYecZW15qvt1E2E6Hm608b+K37bqL+FKobNj78B+KQr4erb0183
|
|
/Kqo0TKDtsUzr20sNFWgeQWgHP/EqyWyJuB2zfOSb1vGUViiuxJfMxajzfE2tKqh
|
|
IDG/QpMvRolJFKSWdQnF08NIYLXfffZ4Sz9+VDCdfeLEQKi+LT6DJnlGDz/rR5iB
|
|
TwyMg3AbobpGuuV0puOZTul2GiHaPwh/fJR8JoG13+kK5VznvrOXopLAl2CVAjtj
|
|
mNuHeQHwaSQanSXgKtYxZG4/w1JDMSr60FKgG7FizhJ+9WAbjPySbb+wV5qJD4oY
|
|
a8F2urt3Tj1c1l4juOctVW+NVSS96idpf9NsmsmticTujgBu+2k63+cSIchiNj1B
|
|
ZcPw5PLgiC/r0P6FITrwXa7zJLNHdFrPvNihKTlEHJAgGno7FJJpdagxmcfGnpb2
|
|
74VlbQF7Tq+9NQJU23y9Vj3YL0XERB/b45oRHkBEoVJKgK9/4U4mzFufn4PfANUt
|
|
0hcgMlxTOVKt0S405dh4I6ok51iq6XDol18QoYbXJHqMuEq7Lo80fKuq8gpKmCJ0
|
|
h3NBYJKPUsngfJUisXS7VrQx3zTB8Yyp1BykpCDKET8LVJGmV7c=
|
|
=RMG/
|
|
-----END PGP SIGNATURE-----
|