A vulnerability (CVE-2025-14558) has been identified in the rtsold background process and rtsol utility used in FreeBSD, allowing for remote code execution with root privileges through the sending of a specially crafted packet with an IPv6 router advertisement. RA messages (Router Advertisement) that exploit this vulnerability are not routed and should be discarded by routers. To execute the attack, an attacker must be able to send a specially formatted packet from a system that is on the same network segment as the vulnerable host.
The rtsold background process is used on hosts for automatic IPv6 connection configuration using the SLAAC (StateLess Address AutoConfiguration) mechanism. The host sends an ICMPv6 RS (Router Solicitation) message in multicast mode and waits for RA (Router Advertisement) messages from routers containing information about network prefixes and configuration parameters. The rtsol utility implements similar functionality without launching a background process.
The vulnerability is caused by rtsold passing the 'domain search' list specified in the RA message to the resolvconf utility without validation and without escaping special characters. The resolvconf utility is a shell script that does not validate input. To exploit the vulnerability, it is sufficient to send an RA packet with a name domain, containing special characters, such as 'test`id`test.' The vulnerability has been fixed in the FreeBSD updates 15.0-RELEASE-p1, 14.3-RELEASE-p7, 13.5-RELEASE-p8.
Additionally, the updates in FreeBSD 14.3-RELEASE-p7 and 13.5-RELEASE-p8 (the 15.x branch is not affected) have addressed a vulnerability (CVE-2025-14769) in the ipfw packet filter, which allows for denial of service through the sending of specially crafted packets. The vulnerability manifests only when using the 'tcp-setmss' directive in ipfw rules. The issue is caused by the tcp-setmss handler potentially freeing memory that holds the received packet data under certain circumstances and returning an error. This error was ignored by the rule processing engine, which could allow the next rule to permit the passing of a packet whose data buffer has already been freed, leading to a null pointer dereference.
Source: opennet.ru
