Date: Thu, 01 May 2014 12:38:29 -0700 From: "Ronald F. Guilmette" <rfg@tristatelogic.com> To: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:08.tcp Message-ID: <96385.1398973109@server1.tristatelogic.com> In-Reply-To: <53629582.9010605@delphij.net>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <53629582.9010605@delphij.net>, Xin Li <delphij@delphij.net> wrote: >On 05/01/14 07:19, Karl Pielorz wrote: >> >> >> --On 30 April 2014 04:35:10 +0000 FreeBSD Security Advisories >> <security-advisories@freebsd.org> wrote: >> >>> II. Problem Description >>> >>> FreeBSD may add a reassemble queue entry on the stack into the >>> segment list when the reassembly queue reaches its limit. The >>> memory from the stack is undefined after the function returns. >>> Subsequent iterations of the reassembly function will attempt to >>> access this entry. >> >> Hi, >> >> Does this require an established TCP session to be present? - i.e. >> If you have a host which provides no external TCP sessions (i.e. >> replies 'Connection Refused' / drops the initial SYN) would that >> still be potentially exploitable? > >No. An established TCP session is required. I also have a question.... If one manages a system where (a) all local user accounts are completely and 100% trustworthy and where (b) one has in place ipfw rules which reject all incoming packet *fragments* on all outward-facing interfaces, then is this security problem (relating to the reassembly queue) an issue at all for said system? Or is it rather a non-event in such contexts? Regards, rfg
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?96385.1398973109>