Problem Description:

In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation (NS) can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to match the state created by the Neighbor Discovery and allow replies to be generated.

Impact:

ICMPv6 packets with identifier value of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the state table.

Note:

This advisory introduced additional issues that were addressed by FreeBSD-EN-24:16.pf. Please refer to that erratum for additional fixes.

>= 14.1 lt 14.1_3

>= 14.0 lt 14.0_9

>= 13.3 lt 13.3_5