CVE-2019-5598

HIGH

FreeBSD Packet Filter Bypass via ICMP/ICMP6 Destination IP Spoofing

Title source: llm
STIX 2.1

Description

In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in pf does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet allowing a maliciously crafted ICMP/ICMP6 packet could bypass the packet filter rules and be passed to a host that would otherwise be unavailable.

References (7)

Core 7
Core References
Patch, Vendor Advisory x_refsource_misc
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:06.pf.asc
Third Party Advisory x_refsource_misc
https://www.synacktiv.com/posts/systems/icmp-reachable.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/108395
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190611-0001/

Scores

CVSS v3 7.5
EPSS 0.0233
EPSS Percentile 85.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (2)
freebsd/freebsd 11.2 (9 CPE variants)
freebsd/freebsd 12.0 (3 CPE variants)
Published May 15, 2019
Tracked Since Feb 18, 2026