CVE-2020-7452: Buffer Overflow

Published Apr 28, 2020

Updated

In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel.

Affected Software

10 affected components

FreeBSD FreeBSD=11.3

FreeBSD FreeBSD=11.3-p1

FreeBSD FreeBSD=11.3-p2

FreeBSD FreeBSD=11.3-p3

FreeBSD FreeBSD=11.3-p4

FreeBSD FreeBSD=11.3-p5

FreeBSD FreeBSD=11.3-p6

FreeBSD FreeBSD=12.1

FreeBSD FreeBSD=12.1-p1

FreeBSD FreeBSD=12.1-p2

Remediation

Patch Available

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc

Event History

Apr 28, 2020

CVE Published

via MITRE·11:36 PM

Data Sourced

via MITRE·11:36 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-7452?

The severity of CVE-2020-7452 is critical with a CVSS score of 9.1.

How does CVE-2020-7452 affect FreeBSD?

CVE-2020-7452 affects FreeBSD versions 11.3 and 12.1.

What is the impact of CVE-2020-7452?

The impact of CVE-2020-7452 is that vnet jailed privileged users can potentially panic the host system.

How can I fix CVE-2020-7452?

To fix CVE-2020-7452, you should install the appropriate FreeBSD updates as mentioned in the FreeBSD Security Advisory.

Where can I find more information about CVE-2020-7452?

You can find more information about CVE-2020-7452 in the FreeBSD Security Advisory.