CVE-2025-14769: tcp-setmss Handler DoS Vulnerability

CVE-2025-14769 Overview

CVE-2025-14769 is a Null Pointer Dereference vulnerability affecting the FreeBSD ipfw firewall's tcp-setmss handler. In some cases, the tcp-setmss handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference.

Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the tcp-setmss directive is used and a subsequent rule would allow the traffic to pass.

Critical Impact

Remote attackers can trigger a kernel NULL pointer dereference via specially crafted network packets, causing system crashes and denial of service conditions on FreeBSD systems using ipfw with tcp-setmss rules.

Affected Products

• FreeBSD systems with ipfw firewall enabled
• Systems using the tcp-setmss directive in ipfw rules
• FreeBSD firewall configurations with tcp-setmss followed by allow rules

Discovery Timeline

• 2026-03-09 - CVE CVE-2025-14769 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-14769

Vulnerability Analysis

This vulnerability exists in the FreeBSD ipfw (IP Firewall) packet filter's handling of the tcp-setmss directive. The tcp-setmss option is used to clamp the Maximum Segment Size (MSS) value in TCP SYN packets, which is a common technique for dealing with path MTU discovery issues or preventing fragmentation.

The flaw occurs when the tcp-setmss handler processes certain malformed packets. Under specific conditions, the handler frees the packet data buffer and raises an error, but critically fails to stop the rule processing engine. This means that subsequent firewall rules continue to execute against memory that has already been freed.

When a subsequent rule attempts to allow the traffic, it accesses the now-freed packet data, triggering a NULL pointer dereference. This type of vulnerability (CWE-476) represents a failure to properly validate that a pointer references valid memory before dereferencing it.

Root Cause

The root cause is a logic error in the tcp-setmss handler's error handling path. When the handler encounters an error condition with certain packet types, it deallocates the packet buffer but does not properly signal the rule processing engine to terminate. This creates a use-after-free scenario where subsequent rules operate on invalid memory references.

The error handling should have either:

1. Set appropriate flags to halt rule processing immediately after freeing the packet
2. Avoided freeing the packet data until rule processing was complete
3. Returned a value that would prevent further rule evaluation

Attack Vector

The vulnerability can be exploited remotely over the network without authentication. An attacker can send specially crafted TCP packets to a FreeBSD system running ipfw with:

1. The tcp-setmss directive configured in the ruleset
2. A subsequent rule that would match and allow the malicious traffic

The attack does not require any user interaction and can be initiated from any network location that can route packets to the target system. When triggered, the NULL pointer dereference causes a kernel panic, resulting in immediate system unavailability.

The specific packet characteristics that trigger this condition involve edge cases in TCP header processing that cause the tcp-setmss handler to fail while still permitting rule chain continuation.

Detection Methods for CVE-2025-14769

Indicators of Compromise

• Unexpected kernel panics or system crashes on FreeBSD firewalls
• System logs showing NULL pointer dereference errors in the ipfw subsystem
• Crash dumps indicating failures in the tcp-setmss processing code path
• Repeated system reboots without apparent cause on systems using ipfw

Detection Strategies

• Monitor for kernel panic events with stack traces pointing to ipfw or netinet code paths
• Review ipfw configuration for presence of tcp-setmss directive followed by allow rules
• Implement network traffic analysis to detect anomalous TCP packets with unusual MSS values
• Deploy SentinelOne Singularity to detect exploitation attempts targeting kernel-level vulnerabilities

Monitoring Recommendations

• Enable kernel crash dump collection to capture forensic data during exploitation attempts
• Configure syslog forwarding to capture any pre-crash error messages from the ipfw subsystem
• Implement availability monitoring to detect unexpected system restarts
• Use network-based intrusion detection to identify potential DoS attack patterns

How to Mitigate CVE-2025-14769

Immediate Actions Required

• Review ipfw firewall rules for usage of the tcp-setmss directive
• Consider temporarily removing or commenting out tcp-setmss rules until patched
• Apply the security patch from FreeBSD as documented in the security advisory
• Monitor systems for signs of exploitation attempts or unexpected crashes

Patch Information

FreeBSD has released a security advisory addressing this vulnerability. System administrators should apply the patch available through the FreeBSD Security Advisory.

To update affected FreeBSD systems:

1. Review the official security advisory for specific patch instructions
2. Use freebsd-update for binary updates on supported releases
3. For source-based installations, fetch the latest security patches and rebuild the kernel
4. Reboot the system after applying the kernel patch

Workarounds

• Remove or disable tcp-setmss directives from ipfw rulesets until patches are applied
• Restructure firewall rules to ensure no allow rules follow tcp-setmss directives
• Consider using alternative packet filtering solutions such as pf if tcp-setmss functionality is not critical
• Implement rate limiting or traffic filtering at upstream network devices to reduce exposure

# Temporary workaround: Comment out tcp-setmss rules
# Review your /etc/ipfw.rules or equivalent configuration file
# Original rule (vulnerable configuration):
# ipfw add 100 tcp-setmss 1440 tcp from any to any setup

# Commented out until patch applied:
# ipfw add 100 tcp-setmss 1440 tcp from any to any setup

# Alternative: Use a deny rule instead of relying on tcp-setmss
ipfw add 100 deny tcp from any to any tcpflags syn tcpoptions mss