PT-2023-7977 · Freebsd · Freebsd

Ao Wang + 4 · Published 2023-12-05 · Updated 2024-01-12 · CVE-2023-6534

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8 FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6 FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1

Description The pf(4) packet filter in FreeBSD incorrectly validates TCP sequence numbers, which could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall. This issue is related to improper access control in the packet filter component.

Recommendations For FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8, update to 12.4-RELEASE-p9 or later. For FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6, update to 13.2-RELEASE-p7 or later. For FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1, update to 14.0-RELEASE-p2 or later. As a temporary workaround, consider restricting access to the pf(4) packet filter until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-09061

CVE-2023-6534

FREEBSD-SA-23_17

Affected Products

Freebsd

References · 11

• https://bdu.fstec.ru/vul/2023-09061 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-23:17.pf.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6534 · Security Note
• https://twitter.com/openbsd/status/1732218968201449617 · Twitter Post
• https://twitter.com/CVEnew/status/1734855472895713619 · Twitter Post
• https://t.me/cvenotify/63423 · Telegram Post
• https://t.me/cvenotify/67233 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734901606645125575 · Twitter Post
• https://t.me/cvenotify/64163 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240112-0007 · Note