[原文]ipfw in FreeBSD 5.4, when running on Symmetric Multi-Processor (SMP) or Uni Processor (UP) systems with the PREEMPTION kernel option enabled, does not sufficiently lock certain resources while performing table lookups, which can cause the cache results to be corrupted during multiple concurrent lookups, allowing remote attackers to bypass intended access restrictions.
FreeBSD Security Advisory FreeBSD-SA-05:13 - The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.
-----BEGIN PGP SIGNED MESSAGE-----
FreeBSD-SA-05:13.ipfw Security Advisory
The FreeBSD Project
Topic: ipfw packet matching errors with address tables
Credits: Max Laier
Affects: FreeBSD 5.4-RELEASE
Corrected: 2005-06-29 21:38:48 UTC (RELENG_5, 5.4-STABLE)
2005-06-29 21:41:03 UTC (RELENG_5_4, 5.4-RELEASE-p3)
CVE Name: CAN-2005-2019
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
ipfw(8) is a system facility which allows IP packet filtering,
redirecting, and traffic accounting. ipfw lookup tables are a way to
specify many IP addresses which can be used for packet matching in an
II. Problem Description
The ipfw tables lookup code caches the result of the last query. The
kernel may process multiple packets concurrently, performing several
concurrent table lookups. Due to an insufficient locking, a cached
result can become corrupted that could cause some addresses to be
incorrectly matched against a lookup table.
When lookup tables are used with ipfw, packets may on very rare
occasions incorrectly match a lookup table. This could result in a
packet being treated contrary to the defined packet filtering ruleset.
For example, a packet may be allowed to pass through when it should
have been discarded.
The problem can only occur on Symmetric Multi-Processor (SMP) systems,
or on Uni Processor (UP) systems with the PREEMPTION kernel option
enabled (not the default).
a) Do not use lookup tables.
b) Disable concurrent processing of packets in the network stack by
setting the "debug.mpsafenet=0" tunable:
# echo "debug.mpsafenet=0" >> /boot/loader.conf
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4
security branch dated after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.4
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:13/ipfw.patch.asc
b) Apply the patch.
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
-----END PGP SIGNATURE-----
FreeBSD ipfw on Symmetric Multi-Processor (SMP) systems and Uni Processor (UP) systems compiled with the PREEMPTION kernel option contains a flaw that may allow a malicious user to bypass ipfw lookup table rulesets. The issue is triggered when the kernel performs concurrent ipfw table lookups using cached results that have become corrupted due to insufficient locking. This could result in an incoming packet being treated contrary to a defined packet filtering ruleset. It is possible that the flaw may allow unauthorized access.
FreeBSD has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing one of the following workarounds: stop using lookup tables or disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable: # echo "debug.mpsafenet=0" >> /boot/loader.conf
FreeBSD IPFW is prone to an atomicity error that might result in erroneous lookup table matching under certain circumstances. Reports indicate the issue exists on SMP (Symmetric Multi-Processor) based platforms, or on UP (Uni Processor) platforms that have a system kernel configured with 'PREEMPTION' functionality enabled. (Note: This is not a default configuration).
This issue may be leveraged to aid in attacks launched against target computers that are protected by the affected firewall.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: email@example.com <mailto:firstname.lastname@example.org>.
The vendor has released an advisory (FreeBSD-SA-05:13.ipfw) and fixes to address this issue.