Problem Description:
In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When
pf is configured to allow ND and block incoming Echo Requests, a
crafted Echo Request packet after a Neighbor Solicitation (NS) can
trigger an Echo Reply. The packet has to come from the same host
as the NS and have a zero as identifier to match the state created
by the Neighbor Discovery and allow replies to be generated.
Impact:
ICMPv6 packets with identifier value of zero bypass firewall
rules written on the assumption that the incoming packets are going
to create a state in the state table.
Note:
This advisory introduced additional issues that were addressed by
FreeBSD-EN-24:16.pf. Please refer to that erratum for additional
fixes.