-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-25:11.ipfw                                       Security Advisory
                                                          The FreeBSD Project

Topic:          ipfw denial of service

Category:       core
Module:         ipfw
Announced:      2025-12-16
Affects:        FreeBSD 13 and 14
Corrected:      2025-11-04 00:52:54 UTC (stable/14, 14.3-STABLE)
                2025-12-16 23:43:24 UTC (releng/14.3, 14.3-RELEASE-p7)
                2025-11-04 00:52:12 UTC (stable/13, 13.5-STABLE)
                2025-12-16 23:43:32 UTC (releng/13.5, 13.5-RELEASE-p8)
CVE Name:       CVE-2025-14769

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

ipfw(4) is one of the firewalls provided in the FreeBSD base system.  Its
`tcp-setmss` configuration directive allows the system administrator to lower
the Maximum Segment Size of a packet.

II.  Problem Description

In some cases, the `tcp-setmss` handler may free the packet data and throw an
error without halting the rule processing engine.  A subsequent rule can then
allow the traffic after the packet data is gone, resulting in a NULL pointer
dereference.

III. Impact

Maliciously crafted packets sent from a remote host may result in a Denial of
Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would
allow the traffic to pass.

IV.  Workaround

No workaround is available, but systems that do not use ipfw(4) with the
`tcp-setmss` directive are not affected.

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date, and
reboot the system.

Perform one of the following:

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 14.3]
# fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch
# fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch.asc
# gpg --verify ipfw-14.patch.asc

[FreeBSD 13.5]
# fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch
# fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch.asc
# gpg --verify ipfw-13.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              deb684f9d1d6    stable/14-n272799
releng/14.3/                            c0cb68169beb  releng/14.3-n271453
stable/13/                              94360584542a    stable/13-n259534
releng/13.5/                            60026b06366f  releng/13.5-n259185
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284606>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14769>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-25:11.ipfw.asc>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmlB+cAACgkQbljekB8A
Gu9XFA//V2aCX1XCn6tCRPR51ixMJ/9rKfpWmYpGruZoB1GaKC0UvkQqDNIkXw8K
r6OY1G2rK36y+AGCrxtXHnUKfDj/hzZkL4lEBr9AjcB6N4czk6q/fSuzcL0FCi9T
CbWjxSEjV2M2IO4nObu8CKB/7cVY6UlIhe2d4iBH+otkzfyBsYHwCSvhDOWxeWFj
f+I9ddOvCFv7lRh74RZk0CdSPe4HyptCSkwERwIn5Cm+fk7PJIFWDM4hF9atP+G8
VT3PUirG1na33vtfRw46c/Qj+L8gybq0pztkTnqsm52WME0n1go3aI7mbPmSWTwe
xSC5totcYxbjQ/lMcXv00kgDzraFuPSzSzej6Z4BYXTHOgNTgHHexa3rqxs8y3i/
IoOWSDZdyd2d3B9r5xAFSzp+HVv+C9UBB/AQ0kQt0gPTX6j9d0WiMninNiedVSWf
BOYCmgvI7+0ybeV54QFrVnEsImEoYu32NlLVVmswSnDOBuBcU2XtHtO7/x5BUcyU
CdOiAZ78TS+007QllROCuidXiQc0FNFqgm+rRFv37Wmmm0LZVkVJ7OVB0vXuk4ps
iNBFmXxHCiKL6zJGvx+OQmAXLE+xf71n9xt0jJIk/NfI1BkHYRrlYnH7JXhfBvAO
SYtM+FXK1Kehj+ltLUO+9WYhkgfAUtlI/+7GKLMDzy76Q+ZMzhk=
=0OhG
-----END PGP SIGNATURE-----