CVE-2020-7469: Use After Free
In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a routing option caches a pointer into the packet buffer holding the ICMPv6 message. However, when processing subsequent options the packet buffer may be freed, rendering the cached pointer invalid. The network stack may later dereference the pointer, potentially triggering a use-after-free.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7469?
CVE-2020-7469 is a vulnerability in FreeBSD that allows an attacker to cache a pointer into the packet buffer holding the ICMPv6 message, which can lead to remote code execution.
How severe is CVE-2020-7469?
CVE-2020-7469 has a severity rating of 7.5 (high).
Which versions of FreeBSD are affected by CVE-2020-7469?
FreeBSD versions 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11, and 11.4-RELEASE before p5 are affected by CVE-2020-7469.
How can I fix CVE-2020-7469?
To fix CVE-2020-7469, users should update to FreeBSD 12.2-STABLE r367402, 11.4-STABLE r368202, 12.2-RELEASE p1, 12.1-RELEASE p11, or 11.4-RELEASE p5 or later versions.
Where can I find more information about CVE-2020-7469?
More information about CVE-2020-7469 can be found in the FreeBSD security advisory at https://security.FreeBSD.org/advisories/FreeBSD-SA-20:31.icmp6.asc.