FreeBSD 12.4

#1

Post by SpaceInvader » Tue, Dec 06, 2022, 8:31 AM UTC

Re: FreeBSD 12.4

#2

Post by gjadi » Tue, Dec 06, 2022, 9:09 AM UTC

Congrats to the team.

I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15...

Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities.

1: https://www.freebsd.org/releases/12.4R/relnotes/

Re: FreeBSD 12.4

#3

Post by eska » Tue, Dec 06, 2022, 9:31 AM UTC

On one hand it’s great FreeBSD uses capability sandboxing, on the other I’m sick of memory errors since the day before yesterday.

Re: FreeBSD 12.4

#4

Post by trasz2 » Tue, Dec 06, 2022, 10:05 AM UTC

gjadi wrote: post #2

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/

Note that, thanks to capsicum(4), this vulnerability is not very exploitable.

Re: FreeBSD 12.4

#5

Post by gjadi » Tue, Dec 06, 2022, 10:58 AM UTC

trasz2 wrote: post #4

gjadi wrote: post #2

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/

Note that, thanks to capsicum(4), this vulnerability is not very exploitable.

Thanks, I didn't know about capsicum(4) and I completely overlooked the mention of sandboxing in the impact section.

Re: FreeBSD 12.4

#6

Post by boomboomsubban » Tue, Dec 06, 2022, 12:15 PM UTC

gjadi wrote: post #2

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/

I would assume there's some level of communication between the various security teams, enough that someone would check if OpenBSD/MacOS had the same bug before they went public with it at least.

Re: FreeBSD 12.4

#7

Post by rwaksmunski » Tue, Dec 06, 2022, 12:43 PM UTC

gjadi wrote: post #2

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/

> The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.

Re: FreeBSD 12.4

#8

Post by rurban » Tue, Dec 06, 2022, 12:46 PM UTC

gjadi wrote: post #2

Congrats to the team. I looked briefly at the relnotes[1], there is some scary stuff, such as this vulnerability in ping(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-22:15... Since a lot of code is shared between BSDs, I wonder if others have the same vulnerabilities. 1: https://www.freebsd.org/releases/12.4R/relnotes/

This ping vuln is not shared anywhere. It is based on a freebsd-specific "optimization" from 2019. Other pings are totally different, I also have my own ping, and it's not affected.

Re: FreeBSD 12.4

#9

Post by YPPH » Tue, Dec 06, 2022, 1:28 PM UTC

Something I've really come to appreciate with OpenBSD is the stability and ease of in-place upgrades. I'm not very familiar with FreeBSD, but from what I've read it seems it too has stable, straightforward, in-place version upgrades. I'd love to hear people's experiences.

I've found with Linux distributions that aren't rolling releases, things tend to break in annoying and insidious ways, such that you generally need to, or at least it is strongly advisable to, fresh install each time.

This is probably of less importance given the demise of the monolithic server, but for my own server, I really appreciate it and the avoidance of reconfiguring everything.

Re: FreeBSD 12.4

#10

Post by comprev » Tue, Dec 06, 2022, 1:38 PM UTC

YPPH wrote: post #9

Something I've really come to appreciate with OpenBSD is the stability and ease of in-place upgrades. I'm not very familiar with FreeBSD, but from what I've read it seems it too has stable, straightforward, in-place version upgrades. I'd love to hear people's experiences. I've found with Linux distributions that aren't rolling releases, things tend to break in annoying and insidious ways, such that you generally need…

It does have a solid and well documented upgrade process, provided you're on the latest stable version prior to executing the upgrade.

Fall behind by 3 or 4 versions and it's a long laborious task to upgrade each one. For products containing the OS which are shipped out to customers (NAS, firewalls, appliances, etc) this process might be too high risk, so it's easier to never upgrade - but ship new hardware, usually in the form of a new product.

(This is from personal experience taking on a client who still ran internet-facing FreeBSD 9.x servers. Lift & shift to the latest FreeBSD 13.x was far safer)