FreeBSD TCP stack timer overflow vulnerability fixed
Key Takeaway
A signed integer overflow in the TCP stack can cause timers to fail, leading to resource exhaustion.
Summary
A vulnerability in the FreeBSD TCP stack allows timers to overflow, causing them to fire late or not at all. This affects FreeBSD 15.1 and 14.4, potentially leading to memory exhaustion and port depletion as connections remain in the connection table indefinitely.
Technical details of the TCP timer overflow
- Since FreeBSD 14.0, the TCP stack multiplexes timers (retransmission, persist, keepalive, 2MSL, and delayed ACK) onto a single callout(9) per connection.
- When a timer is stopped, its expiry time is set to SBT_MAX, but its previously computed precision is retained.
- The stack adds this precision to SBT_MAX, triggering a signed integer overflow.
- This results in a negative value being used for scheduling, causing timers to malfunction.
- Affected connections can be identified via netstat -nxptcp by looking for negative or implausibly large values in timer columns.
Why it matters
Systems running affected FreeBSD versions may experience stability issues or denial of service due to memory and port exhaustion.
Original reference: www.freebsd.org →