Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by enrico204 on Friday September 08, 2023 @04:39PM
(#37439099)
Author here. I confirm that OPNSense was vulnerable. It has been fixed in v23.7.1 (August 8, 2023): https://forum.opnsense.org/index.php?topic=35298.0
We haven't tested pfSense, but I suppose that they are vulnerable too as they use `pf` and they are FreeBSD-based.
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by justsomehnguy on Friday September 08, 2023 @05:25PM
(#37439637)
Thanks!
Can you clarify, does that works on the forwarded packets? I assume it should, given the vuln in the scrubbing function, but it would help if that would be stated clearly.
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by enrico204 on Friday September 08, 2023 @05:34PM
(#37439720)
Yes, it works on forwarded packets. In the example ruleset in the blog post, `em1` and `em2` are two network interfaces (victim and attacker, think them as LAN and WAN respectively), and the FreeBSD machine is configured as router/firewall.
> Additionally, the scrubbing process has fixed the packet, so now any operating system behind the firewall accepts the packet.
Ie if you are running a router based on pf (including pfSene and OPNSense, I suppose) you are probably fine, because you have only ssh and webgui on this host.
If you have a full OS running some services (eg MySQL and like) for which you rely on the firewall to block the external connections (instead of binding to localhost or LAn interface) then you are at risk.
Attacker should know what you are running that service or probe the known running hosts, so the opportunity is low.
ADD: it's not clear for me, but looks like this works for the forwarded (aka routed) packets as well. If yes, the 'known hosts' still apply but exposure is a bit bigger. If you are running pf firewalls with a full IPV6 connectivity - update ASAP.