PT-2021-12655 · Freebsd · Freebsd

Published 2020-09-15 · Updated 2021-04-01 · CVE-2020-7464

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.2-STABLE before r365730 FreeBSD versions 11.4-STABLE before r365738 FreeBSD versions 12.1-RELEASE before p10 FreeBSD versions 11.4-RELEASE before p4 FreeBSD versions 11.3-RELEASE before p14

Description: A programming error in the ure(4) device driver causes some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. This can be exploited by an adversary to cause the driver to misinterpret part of the payload of a large packet as a separate packet, allowing packets to be injected across security boundaries such as VLANs.

Recommendations: For FreeBSD versions 12.2-STABLE before r365730, update to a version after r365730. For FreeBSD versions 11.4-STABLE before r365738, update to a version after r365738. For FreeBSD versions 12.1-RELEASE before p10, update to a version after p10. For FreeBSD versions 11.4-RELEASE before p4, update to a version after p4. For FreeBSD versions 11.3-RELEASE before p14, update to a version after p14.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-7464

FREEBSD-SA-20_27

Affected Products

Freebsd

References · 8

• https://security.freebsd.org/advisories/FreeBSD-SA-20:27.ure.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7464 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7464 · Vendor Advisory
• https://t.me/cvenotify/12177 · Telegram Post
• https://t.me/cvenotify/12200 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-20:27.ure.asc · Note
• https://t.me/cvenotify/12212 · Telegram Post
• https://t.me/cvenotify/12132 · Telegram Post