CVE-2019-5597

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-15 · updated 2026-06-17
Weakness: CWE-20

Description

In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of the first packet allowing maliciously crafted IPv6 packets to cause a crash or potentially bypass the packet filter.

Affected products

FreeBSD: 11.2, 11.2-p2, 11.2-p3, 11.2-p4, 11.2-p5, 11.2-p6 (+5)

References

http://packetstormsecurity.com/files/152933/FreeBSD-Security-Advisory-FreeBSD-SA-19-05.pf.html
http://www.securityfocus.com/bid/108395
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:05.pf.asc
https://security.netapp.com/advisory/ntap-20190611-0001/
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf
http://packetstormsecurity.com/files/152933/FreeBSD-Security-Advisory-FreeBSD-SA-19-05.pf.html
http://www.securityfocus.com/bid/108395
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:05.pf.asc
https://security.netapp.com/advisory/ntap-20190611-0001/
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf

Get alerted when CVE-2019-5597 or the next vulnerability affects your stack