PT-2021-18375 · Freebsd · Freebsd

Alexey Kulaev · Published 2021-04-06 · Updated 2022-05-27 · CVE-2021-29627

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 13.0-STABLE before n245050 FreeBSD versions 12.2-STABLE before r369525 FreeBSD versions 13.0-RC4 before p0 FreeBSD versions 12.2-RELEASE before p6

Description The issue arises from listening socket accept filters implementing the accf create callback, which incorrectly free a process-supplied argument string. This can lead to a double free or use after free when additional operations are performed on the socket.

Recommendations For FreeBSD versions 13.0-STABLE before n245050, update to a version after n245050. For FreeBSD versions 12.2-STABLE before r369525, update to a version after r369525. For FreeBSD versions 13.0-RC4 before p0, update to a version after p0. For FreeBSD versions 12.2-RELEASE before p6, update to a version after p6.

Exploit

Fix

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

CVE-2021-29627

FREEBSD-SA-21_09

Affected Products

Freebsd

References · 9

• 🔥 https://github.com/raymontag/cve-2021-29627 · Exploit
• https://security.freebsd.org/advisories/FreeBSD-SA-21:09.accept_filter.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29627 · Security Note
• https://t.me/cvenotify/13580 · Telegram Post
• https://t.me/cvenotify/13354 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210423-0007 · Note
• https://t.me/cybersecuritytechnologies/3112 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-21:09.accept_filter.asc · Note