A vulnerability (CVE-2022-23093) has been discovered in the ping utility included in the base distribution of FreeBSD. This issue could potentially lead to remote code execution with root privileges when checking an external host controlled by an attacker using ping. Fixes have been proposed in FreeBSD updates 13.1-RELEASE-p5, 12.4-RC2-p2, and 12.3-RELEASE-p10. It is still unclear whether other BSD systems are affected by this vulnerability (reports of vulnerabilities in NetBSD, DragonFlyBSD, and OpenBSD have not yet surfaced).
The vulnerability is caused by a buffer overflow in the code parsing ICMP messages returned in response to the ping request. The code for sending and receiving ICMP messages in ping uses raw sockets and runs with elevated privileges (the utility is delivered with the setuid root flag). The response is processed on the ping side through the reconstruction of IP and ICMP headers from the packets received from the raw socket. The allocated IP and ICMP headers are copied by the pr_pack() function into buffers without considering that additional extended headers may be present in the packet after the IP header.
Such headers are extracted from the packet and included in the header block, but are not accounted for in the buffer size calculation. If a host returns a packet with additional headers in response to the sent ICMP request, their contents will be written into a region beyond the buffer in the stack. Consequently, an attacker may overwrite up to 40 bytes of data in the stack, potentially allowing them to execute their code. The danger of this issue is mitigated by the fact that at the time of the error, the process is in a state of isolation for system calls (capability mode), making it difficult to gain access to the rest of the system after exploiting the vulnerability.
Source: opennet.ru
