CVE-2020-7457
high · 8.1In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.
8.1
CVSS
33.1%
EPSS (exploit prob.)
98th
EPSS percentile
2020-07-09
Published
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362CWE-416CWE-662
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.3 |
| freebsd | freebsd | 11.4 |
| freebsd | freebsd | 11.4 |
| freebsd | freebsd | 11.4 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
| freebsd | freebsd | 12.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:20.ipv6.asc
- https://security.netapp.com/advisory/ntap-20200724-0002/
- http://packetstormsecurity.com/files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:20.ipv6.asc
- https://security.netapp.com/advisory/ntap-20200724-0002/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-7457