2 lines
5.9 KiB
JSON
2 lines
5.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["tcp"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p5","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p1","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p10","status":"affected","version":"14.3-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf.\n\nIf an attacker is either on path with an established TCP connection, or can themselves establish a TCP connection, to an affected FreeBSD machine, they can easily craft and send packets which meet the challenge ACK criteria and cause the FreeBSD host to leak an mbuf for each crafted packet in excess of the configured rate limit settings i.e. with default settings, crafted packets in excess of the first 5 sent within a 1s period will leak an mbuf.\n\nTechnically, off-path attackers can also exploit this problem by guessing the IP addresses, TCP port numbers and in some cases the sequence numbers of established connections and spoofing packets towards a FreeBSD machine, but this is harder to do effectively."},{"lang":"es","value":"Cuando se debe enviar un ACK de desafío, tcp_respond() construye y envía el ACK de desafío y consume el mbuf que se le pasa. Cuando no se debe enviar ningún ACK de desafío, la función retorna y fuga el mbuf.\n\nSi un atacante está en la ruta de una conexión TCP establecida, o puede establecer una conexión TCP por sí mismo, a una máquina FreeBSD afectada, puede fácilmente crear y enviar paquetes que cumplen los criterios del ACK de desafío y hacer que el host FreeBSD fugue un mbuf por cada paquete creado en exceso de la configuración del límite de velocidad configurado, es decir, con la configuración predeterminada, los paquetes creados en exceso de los primeros 5 enviados dentro de un período de 1s fugarán un mbuf.\n\nTécnicamente, los atacantes fuera de ruta también pueden explotar este problema adivinando las direcciones IP, los números de puerto TCP y en algunos casos los números de secuencia de las conexiones establecidas y suplantando paquetes hacia una máquina FreeBSD, pero esto es más difícil de hacer de manera efectiva."}],"id":"CVE-2026-4247","lastModified":"2026-06-17T10:56:17.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4247","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-26T14:40:37.721602Z","version":"2.0.3"}}]},"published":"2026-03-26T07:16:20.387","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:06.tcp.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
|