A vulnerability in the FreeBSD tcp-setmss handler permits unauthenticated remote attackers to trigger a system crash, resulting in a denial of service.

The vulnerability is a NULL pointer dereference (CWE-476) occurring when the tcp-setmss handler incorrectly frees packet data while allowing subsequent rules to process the traffic. This flaw is reachable by unauthenticated remote attackers who can trigger the error condition through specific packet sequences.

The exploitation of this vulnerability leads to a denial of service, which can cause significant operational disruption by crashing network-facing systems. With a CVSS score of 7.5, the impact is rated as High due to the ease of remote execution and the potential for total service unavailability. Organizations relying on FreeBSD for critical infrastructure may face extended downtime until the system is recovered.

Immediate Action: Update FreeBSD systems to the patched versions (14.3-RELEASE-p7 or 13.5-RELEASE-p8) as specified in the official FreeBSD security advisory.

Proactive Monitoring: Monitor system logs for unexpected kernel panics or service interruptions that correlate with high volumes of TCP traffic.

Compensating Controls: If patching is not immediately feasible, consider disabling the tcp-setmss directive within the ipfw configuration to prevent the triggering of the vulnerable code path.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for remote denial of service, this vulnerability presents a significant stability risk to FreeBSD environments. Administrators should prioritize the application of the vendor-provided security patches to eliminate the underlying NULL pointer dereference and ensure network service continuity.