Description
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | kfreebsd-9 | 9.0-10+deb70.10 | DSA-3175-2 |
Advisories 1
- DSA-3175-2 kfreebsd-9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://openwall.com/lists/oss-security/2015/04/04/2
- https://lists.freebsd.org/pipermail/freebsd-net/2015-April/041934.html
- https://www.freebsd.org/security/advisories/FreeBSD-SA-15:09.ipv6.asc
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6fd99094de2b83d1d4c8457f2c83483b2828e75a