Page 1 of 1

FreeBSD Security Advisory FreeBSD-SA-05:13.ipfw

Posted: 08:07 Thursday 30 Jun 2005
by Driv3r
Hash: SHA1

FreeBSD-SA-05:13.ipfw Security Advisory
The FreeBSD Project

Topic: ipfw packet matching errors with address tables

Category: core
Module: netinet
Announced: 2005-06-29
Credits: Max Laier
Affects: FreeBSD 5.4-RELEASE
Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE)
2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3)
CVE Name: CAN-2005-2019

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit

I. Background

ipfw(8) is a system facility which allows IP packet filtering,
redirecting, and traffic accounting. ipfw lookup tables are a way to
specify many IP addresses which can be used for packet matching in an
efficient manner.

II. Problem Description

The ipfw tables lookup code caches the result of the last query. The
kernel may process multiple packets concurrently, performing several
concurrent table lookups. Due to an insufficient locking, a cached
result can become corrupted that could cause some addresses to be
incorrectly matched against a lookup table.

III. Impact

When lookup tables are used with ipfw, packets may on very rare
occasions incorrectly match a lookup table. This could result in a
packet being treated contrary to the defined packet filtering ruleset.
For example, a packet may be allowed to pass through when it should
have been discarded.

The problem can only occur on Symmetric Multi-Processor (SMP) systems,
or on Uni Processor (UP) systems with the PREEMPTION kernel option
enabled (not the default).

IV. Workaround

a) Do not use lookup tables.


b) Disable concurrent processing of packets in the network stack by
setting the "debug.mpsafenet=0" tunable:

# echo "debug.mpsafenet=0" >> /boot/loader.conf

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4
security branch dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.4

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch ... ipfw.patch
# fetch ... .patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:> and reboot the

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
- -------------------------------------------------------------------------
src/UPDATING 1.342.
- -------------------------------------------------------------------------

VII. References ... -2005-2019

The latest revision of this advisory is available at ... 3.ipfw.asc
Version: GnuPG v1.4.1 (FreeBSD)

_______________________________________________ mailing list ... ifications
To unsubscribe, send any mail to ""

Posted: 21:38 Wednesday 13 Jul 2005
by Vells
shis laikam cik sapratu tikai uz freebsd 5.x attiecas ?