SB2020031933 - Multiple vulnerabilities in FreeBSD

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020031933

SB2020031933 - Multiple vulnerabilities in FreeBSD

Published: March 19, 2020

Security Bulletin ID SB2020031933
Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Memory leak (CVE-ID: CVE-2020-7451)

The vulnerability allows a remote attacker to gain access to sensitive kernel information.

The vulnerability exists due memory leak in IPv6 implementation in FreeBSD, when processing network traffic over TCP, which leads to disclosure of one byte of kernel memory with every TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6. A remote attacker can initiate a TCP connection over IPv6 protocol with an affected system and gain access to sensitive information, stored in kernel.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-15876)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient privilege checking in oce IOCTL. A local user can run a specially crafted application to send arbitrary commands to device firmware and escalate privileges on the system.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-15877)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient privilege checking in ixl IOCTL. A local user can run a specially crafted application to trigger updates to the device's non-volatile memory (NVM).


4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-7452)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect usage of potentially user-controlled pointer within the epair interface in kernel. A local vnet jailed user with root level access (or the PRIV_NET_IFCREATE privilege) cab cause the system panic or execute arbitrary code kernel privileges on the system.


5) Resource management error (CVE-ID: CVE-2020-7453)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a missing NUL-termination check for the jail_set(2) configration option "osrelease" that leads disclosure of additional bytes of kernel memory than was originally set. A local privileges user inside a non-default jail, e.g. setting of children.max > 0 ("nested jails"), can read exposed kernel memory.


Remediation

Install update from vendor's website.

References