PT-2021-12653 · Freebsd · Freebsd

Published 2020-09-02 · Updated 2021-04-02 · CVE-2020-7462

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 11.3-RELEASE before p13 FreeBSD versions 11.4-PRERELEASE before r360733

Description: The issue is caused by improper mbuf handling in the kernel, leading to a use-after-free bug when sending IPv6 Hop-by-Hop options over the loopback interface. This may result in unintended kernel behavior, including a kernel panic.

Recommendations: For FreeBSD versions 11.3-RELEASE before p13, update to p13 or later to resolve the issue. For FreeBSD versions 11.4-PRERELEASE before r360733, update to r360733 or later to resolve the issue. As a temporary workaround, consider restricting the use of IPv6 Hop-by-Hop options over the loopback interface until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-7462

FREEBSD-SA-20_24

Affected Products

Freebsd

References · 6

• https://osv.dev/vulnerability/CVE-2020-7462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7462 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-20:24.ipv6.asc · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-20:24.ipv6.asc · Note
• https://t.me/cvenotify/12131 · Telegram Post
• https://t.me/cvenotify/12176 · Telegram Post