Juha-Matti Tilli

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions prior to 11.2-RELEASE-p1 FreeBSD versions prior to 11.1-RELEASE-p12 FreeBSD versions prior to 10.4-RELEASE-p10 **Description** The issue is related to an inefficient algorithm used for TCP reassembly in the affected operating systems. This inefficiency can be exploited by a remote attacker who sends specially crafted TCP traffic, potentially leading to a denial of service by consuming excessive CPU resources and degrading network performance. The exploitation can be achieved with relatively small bandwidth cost. **Recommendations** For versions prior to 11.2-RELEASE-p1, update to 11.2-RELEASE-p1 or later. For versions prior to 11.1-RELEASE-p12, update to 11.1-RELEASE-p12 or later. For versions prior to 10.4-RELEASE-p10, update to 10.4-RELEASE-p10 or later.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.9 and later PAN-OS versions prior to 6.1.22 PAN-OS versions prior to 7.1.20 PAN-OS versions prior to 8.0.13 PAN-OS versions prior to 8.1.5 Arista EOS (affected versions not specified) vEOS (affected versions not specified) CloudVision Portal (affected versions not specified) CloudVision Appliance (affected versions not specified) Check Point GAiA (affected versions not specified) Description: The issue is related to a denial of service attack that can be triggered by sending specially crafted IP fragments, causing CPU saturation and consuming excessive resources. This can lead to a denial of service condition. The vulnerability is known as a FragmentSmack attack and affects the Linux kernel's handling of IP fragment reassembly. Remote attackers can exploit this issue by sending fragmented IPv4 or IPv6 packets to the affected device. Recommendations: For Linux kernel versions 3.9 and later, consider disabling IP fragment reassembly or restricting the size of the IP fragment reassembly queue as a temporary workaround until a patch is available. For PAN-OS versions prior to 6.1.22, update to version 6.1.22 or later. For PAN-OS versions prior to 7.1.20, update to version 7.1.20 or later. For PAN-OS versions prior to 8.0.13, update to version 8.0.13 or later. For PAN-OS versions prior to 8.1.5, update to version 8.1.5 or later. For Arista EOS, vEOS, CloudVision Portal, and CloudVision Appliance, refer to the vendor's documentation for affected versions, mitigation, and resolution. For Check Point GAiA, at the moment, there is no information about a newer version that contains a fix for this vulnerability.