CVE-2019-5608 : Security Advisory and Response

FreeBSD versions before 12.0-RELEASE-p9, 11.3-RELEASE-p2, and 11.2-RELEASE-p13 are affected by a vulnerability in the ICMPv6 input path that could allow a remote attacker to trigger an out-of-bounds read or write, potentially leading to a kernel panic.

Understanding CVE-2019-5608

Before r350648, FreeBSD 12.0-STABLE, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13 suffer from a flaw in the ICMPv6 input path. This flaw occurs when an MLDv2 listener query packet is internally fragmented across multiple mbufs. Exploiting this vulnerability, a remote attacker could potentially trigger an out-of-bounds read or write. Consequently, the kernel may attempt to access an unmapped page and trigger a panic.

What is CVE-2019-5608?

Vulnerability in the ICMPv6 input path in FreeBSD versions before 12.0-RELEASE-p9, 11.3-RELEASE-p2, and 11.2-RELEASE-p13
Allows a remote attacker to trigger an out-of-bounds read or write
Could lead to a kernel panic

The Impact of CVE-2019-5608

Remote attackers can exploit the vulnerability
Potential for triggering out-of-bounds read or write
Kernel may attempt to access an unmapped page and cause a panic

Technical Details of CVE-2019-5608

Vulnerability Description

Incorrect handling of MLDv2 listener query packet fragmentation
Out-of-bounds read or write possibility
Kernel may attempt to access an unmapped page

Affected Systems and Versions

FreeBSD 12.0-STABLE, 12.0-RELEASE before 12.0-RELEASE-p9
FreeBSD 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2
FreeBSD 11.2-RELEASE before 11.2-RELEASE-p13

Exploitation Mechanism

Exploiting fragmented MLDv2 listener query packets
Triggering out-of-bounds read or write
Potential kernel panic

Mitigation and Prevention

Immediate Steps to Take

Apply the provided patches for FreeBSD versions
Monitor security advisories for updates

Long-Term Security Practices

Regularly update FreeBSD systems
Implement network segmentation and access controls

Patching and Updates

Update FreeBSD to versions 12.0-RELEASE-p9, 11.3-RELEASE-p2, or 11.2-RELEASE-p13