FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- ICMP/ICMP6 packet filter bypass in pf

Affected packages
12.0 <= FreeBSD-kernel < 12.0_4
11.2 <= FreeBSD-kernel < 11.2_10


VuXML ID 59c5f255-b309-11e9-a87f-a4badb2f4699
Discovery 2019-05-14
Entry 2019-07-30

Problem Description:

States in pf(4) let ICMP and ICMP6 packets pass if they have a packet in their payload matching an existing condition. pf(4) does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet.


A maliciously crafted ICMP/ICMP6 packet could bypass the packet filter rules and be passed to a host that would otherwise be unavailable.


CVE Name CVE-2019-5598
FreeBSD Advisory