CVE-2023-4809Not scoredCWE-167

CVE-2023-4809: pf incorrectly handles multiple IPv6 fragment headers

FreeBSD

Vendor fix available · Affected: FreeBSD · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.8%probability of exploitation in the next 30 days

57th percentile

050100

Higher than 57% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

FreeBSD · FreeBSDfrom 13.2-RELEASE before p3; from 12.4-RELEASE before p5

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Handling of Additional Special Element · Injection and Smuggling
Vendor: FreeBSD
Published: September 2023
Band: Unlikely (under 1%), September 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2023-4809 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.