e4e2190aed
Fix devfs rules not applied by default for jails. [SA-14:07] Fix OpenSSL use-after-free vulnerability. [SA-14:08] Fix TCP reassembly vulnerability. [SA-14:09]
154 lines
6 KiB
Text
154 lines
6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:08.tcp Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: TCP reassembly vulnerability
|
|
|
|
Category: core
|
|
Module: inet
|
|
Announced: 2014-04-30
|
|
Credits: Jonathan Looney
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2014-04-30 04:04:20 UTC (stable/8, 8.4-STABLE)
|
|
2014-04-30 04:05:47 UTC (releng/8.4, 8.4-RELEASE-p9)
|
|
2014-04-30 04:05:47 UTC (releng/8.3, 8.3-RELEASE-p16)
|
|
2014-04-30 04:04:20 UTC (stable/9, 9.2-STABLE)
|
|
2014-04-30 04:05:47 UTC (releng/9.2, 9.2-RELEASE-p5)
|
|
2014-04-30 04:05:47 UTC (releng/9.1, 9.1-RELEASE-p12)
|
|
2014-04-30 04:03:05 UTC (stable/10, 10.0-STABLE)
|
|
2014-04-30 04:04:42 UTC (releng/10.0, 10.0-RELEASE-p2)
|
|
CVE Name: CVE-2014-3000
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The Transmission Control Protocol (TCP) of the TCP/IP protocol suite
|
|
provides a connection-oriented, reliable, sequence-preserving data
|
|
stream service. When network packets making up a TCP stream (``TCP
|
|
segments'') are received out-of-sequence, they are maintained in a
|
|
reassembly queue by the destination system until they can be re-ordered
|
|
and re-assembled.
|
|
|
|
II. Problem Description
|
|
|
|
FreeBSD may add a reassemble queue entry on the stack into the segment list
|
|
when the reassembly queue reaches its limit. The memory from the stack is
|
|
undefined after the function returns. Subsequent iterations of the
|
|
reassembly function will attempt to access this entry.
|
|
|
|
III. Impact
|
|
|
|
An attacker who can send a series of specifically crafted packets with a
|
|
connection could cause a denial of service situation by causing the kernel
|
|
to crash.
|
|
|
|
Additionally, because the undefined on stack memory may be overwritten by
|
|
other kernel threads, while extremely difficult, it may be possible for
|
|
an attacker to construct a carefully crafted attack to obtain portion of
|
|
kernel memory via a connected socket. This may result in the disclosure of
|
|
sensitive information such as login credentials, etc. before or even
|
|
without crashing the system.
|
|
|
|
IV. Workaround
|
|
|
|
It is possible to defend to these attacks by doing traffic normalization
|
|
using a firewall. This can be done by including the following /etc/pf.conf
|
|
configuration:
|
|
|
|
scrub in all
|
|
|
|
This requires pf(4) to be enabled, and have the mentioned configuration
|
|
loaded.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:08/tcp.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:08/tcp.patch.asc
|
|
# gpg --verify tcp.patch.asc
|
|
|
|
b) Apply the patch.
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
3) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r265123
|
|
releng/8.3/ r265125
|
|
releng/8.4/ r265125
|
|
stable/9/ r265123
|
|
releng/9.1/ r265125
|
|
releng/9.2/ r265125
|
|
stable/10/ r265122
|
|
releng/10.0/ r265124
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3000>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:08.tcp.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0.22 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJTYHsHAAoJEO1n7NZdz2rngywP/joAE0afufOlFvOsSxeeXUWg
|
|
kNhtEQV5iXgsbu8QPwM/ikmAgg2ONGLQ47A7w7vHF98qg8jk6W1aZCcRE5lIg8hg
|
|
WP5boSFvzvTXIQCo8EsIdcbnNBEA6CrtVQOIvWtuow2z8T0MtSou78Ctq2SO0O+8
|
|
7lY9pFYguFBgUNmVC6jpChIGJS9uZtdz2Vn697B4fOyv1pn6wenW7teOsyN+4Dyj
|
|
7Wq/qppZDrYSnd+YdveUAFCyCoYIXcsLXbeeIVJC2g8x6LlDw8swZElZL6refX6L
|
|
UPDBViI3ctAcjEgzAP1fN3d9FpA5oGJ67J9QcDxYIfTj5YrQiYoTs49ER9FD7k9Q
|
|
UxrgLamZ45/D762/IpmLHCwD+FWdzhl9wufklUptrHNIyNyovwMxQDNnoGZUIKeZ
|
|
x1fAfctXRAztISyQ5xqVw3nKLauPCSG6IniyyZ12BcFxmDvoEcyOFLqB1eN+l5DB
|
|
aJvfiA4PjWIV1nVU+w4MKKAQbHQSgh9bu8EvYUuwNrGOtP49RV1HejWD85ePSgtr
|
|
KOQ0HU8CGmTpWOMkDQBl8Ap1boP9iUOTRp/WuIxwMi+AqoKRuDrWs0sOAXIksu2s
|
|
0sgGnbI0lrg77lBW4FPvMaCg1dlzlfv4J9AExAh6Ur52qxh5GaOcI2NhYWbxvijh
|
|
5wgOBszZXV2kPRDAaJTa
|
|
=uhXC
|
|
-----END PGP SIGNATURE-----
|