PT-2020-19587 · Freebsd · Freebsd

Michael Tuexen · Published 2020-03-19 · Updated 2021-07-21 · CVE-2020-7451

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.1-STABLE before r358739 FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3 FreeBSD versions 11.3-STABLE before r358740 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7

Description A TCP SYN-ACK or challenge TCP-ACK segment over IPv6 that is transmitted or retransmitted does not properly initialize the Traffic Class field, disclosing one byte of kernel memory over the network.

Recommendations For FreeBSD versions 12.1-STABLE before r358739, update to a version after r358739. For FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3, update to 12.1-RELEASE-p3 or later. For FreeBSD versions 11.3-STABLE before r358740, update to a version after r358740. For FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7, update to 11.3-RELEASE-p7 or later.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2020-7451

FREEBSD-SA-20_04

Affected Products

Freebsd

References · 5

• https://osv.dev/vulnerability/CVE-2020-7451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7451 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-20:04.tcp.asc · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-20:04.tcp.asc · Note
• https://t.me/cvenotify/3357 · Telegram Post