pf incorrectly handles multiple IPv6 fragment headers

CVE-2023-4809

What is CVE-2023-4809?

A vulnerability exists in pf's packet processing that could allow IPv6 fragments to evade firewall rules. When handling packets with multiple IPv6 fragment headers under a 'scrub fragment reassemble' rule, pf fails to recognize the correct ultimate payload. Instead, these packets are mistakenly interpreted as fragmented, thus bypassing established firewall controls. This could lead to unauthorized packet forwarding or processing at the host, compromising network security and integrity.

References