# MA-566.012016: MyCERT Advisory - FreeBSD Patches Kernel Panic Vulnerability

**Date:** 28 Jan 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-566.012016  
**Advisory ID:** MA-566.012016

---

####
**1.0 Introduction**
FreeBSD has patched a denial-of-service vulnerability affecting versions configured to support SCTP and IPv6, the default configurations on later version of the open source OS. SCTP is the Stream Control Transmission Protocol, used to facilitate communication between endpoints on the same network. The Internet Control Message Protocol for IPv6 (ICMPv6) provides a way for hosts on the Internet to exchange control information. A host or router can use ICMPv6 to inform a host when there is an error delivering a packet sent by that host.
**2.0 Description**
Referring to this vulnerablity, a lack of proper input checks in the ICMPv6 processing in the SCTP stack can lead to either a failed kernel assertion or to a NULL pointer dereference.  In either case, a kernel panic will follow, kernel panics are the UNIX equivalent of a Windows Blue Screen of Death.  The vulnerability is exploitable remotely and without authentication**.3.0 Impact**
The vulnerability could be exploited to conduct DoS attacks, escalate user privileges, and disclose important/sensitive data.
**4.0 Affected Products**
The affected products are FreeBSD versions 9.3, 10.1 and 10.2.
Kernels compiled without support for SCTP or IPv6 are not vulnerable.
IPv4 ICMP processing is not impacted by this vulnerability.
**5.0 Recommendation**
Perform one of the following:
> 5.1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Rebooting to the new kernel is required.
>
> 5.2) To update your vulnerable system via a binary patch:
>
> Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility:
>
> # freebsd-update fetch
> # freebsd-update install
>
> Rebooting to the new kernel is required.
>
> 5.3) To update your vulnerable system via a source code patch:
>
> The following patches have been verified to apply to the applicable FreeBSD release branches.
>
> a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility.
> # fetch https://security.FreeBSD.org/patches/SA-16:01/sctp.patch
> # fetch https://security.FreeBSD.org/patches/SA-16:01/sctp.patch.asc
> # gpg --verify sctp.patch.asc
>
> b) Apply the patch.  Execute the following commands as root:
> # cd /usr/src
> # patch < /path/to/patch
>
> c) Recompile your kernel as described in:
> <https://www.FreeBSD.org/handbook/kernelconfig.html>
>
> and reboot the system.
>
> 5.4) Correction details
>
> The following list contains the correction revision numbers for each affected branch.
>
> Branch/path                                                      Revision
> --------------------------------------------------------------------------
> stable/9/                                                           r293898
> releng/9.3/                                                       r293896
> stable/10/                                                         r293897
> releng/10.1/                                                     r293894
> releng/10.2/                                                     r293893
> --------------------------------------------------------------------------
>
> To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed:
>
> # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
>
> Or visit the following URL, replacing NNNNNN with the revision number:
> <https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#1a7963787f682323235a7963787f68697f796f68736e63347763) or [[email protected]](/cdn-cgi/l/email-protection#a1ccd8c2c4d3d5e1ccd8c2c4d3d58fced3c68fccd8) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
- FreeBSD Patches Kernel Panic Vulnerability:
<https://threatpost.com/freebsd-patches-kernel-panic-vulnerability/116001/>
- SCTP ICMPv6 error message vulnerability:
<https://www.freebsd.org/security/advisories/FreeBSD-SA-16:01.sctp.asc>
- FreeBSD Remote DoS Exploit (Demo) (CVE-2016-1879)
<http://blog.ptsecurity.com/2016/01/severe-vulnerabilities-detected-in.html>