PT-2021-18376 · Freebsd · Freebsd

Johannes Totz · Published 2021-08-24 · Updated 2021-12-14 · CVE-2021-29630

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 13.0-STABLE before n246938-0729ba2f49c9 FreeBSD versions 12.2-STABLE before r370383 FreeBSD versions 11.4-STABLE before r370381 FreeBSD versions 13.0-RELEASE before p4 FreeBSD versions 12.2-RELEASE before p10 FreeBSD versions 11.4-RELEASE before p13

Description The ggatec daemon in FreeBSD does not validate the size of a response before writing it to a fixed-sized buffer. This allows a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.

Recommendations For FreeBSD versions 13.0-STABLE before n246938-0729ba2f49c9, update to a version after n246938-0729ba2f49c9. For FreeBSD versions 12.2-STABLE before r370383, update to a version after r370383. For FreeBSD versions 11.4-STABLE before r370381, update to a version after r370381. For FreeBSD versions 13.0-RELEASE before p4, update to a version after p4. For FreeBSD versions 12.2-RELEASE before p10, update to a version after p10. For FreeBSD versions 11.4-RELEASE before p13, update to a version after p13.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-29630

FREEBSD-SA-21_14

Affected Products

Freebsd

References · 6

• https://osv.dev/vulnerability/CVE-2021-29630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29630 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-21:14.ggatec.asc · Vendor Advisory
• https://t.me/cibsecurity/28040 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-21:14.ggatec.asc · Note
• https://security.netapp.com/advisory/ntap-20210923-0005 · Note