Versions Affected : All verisons prior to FreeNAS 11.3-U2


Description

pf(4) ioctls frequently take a variable number of elements as argument. This can potentially allow users to request very large allocations.

A failing non-blocking pf(4) allocation can tie up resources resulting in concurrent blocking allocations entering vm_wait() and inducing reclamation of caches. The kernel will reject very large tables to avoid resource exhaustion attacks. Some users run into this limit with legitimate table configurations.


Workaround

No workaround is available, however systems that do not employ pf(4) nor use pf(4) table definitions larger than 65535 entries are unaffected.


Mitigation

  • Upgrade to FreeNAS 11.3-U2 or later.

Commit


Further information