Remotely exploitable vulnerabilities in FreeBSD

In FreeBSD resolved Five vulnerabilities, including issues that could potentially lead to data overwrite at the kernel level when sending certain network packets, or allow a local user to escalate their privileges. The vulnerabilities have been fixed in updates 12.1-RELEASE-p5 and 11.3-RELEASE-p9.

The most dangerous vulnerability (CVE-2020-7454) is caused by inadequate packet size validation in the libalias library when parsing protocol-specific headers. The libalias library is used in the ipfw packet filter for address translation and includes standard functions for address replacement in IP packets and protocol parsing. This vulnerability allows reading or writing of data in the kernel memory area (when using the NAT implementation in the kernel) or in the natd process (when using the NAT implementation in user space) through the sending of specially crafted network packets. The issue does not affect NAT configurations built using pf and ipf packet filters, as well as ipfw configurations that do not use NAT.
CVE-2020-7455

Other vulnerabilities:

• — another remotely exploitable vulnerability in libalias, associated with incorrect packet length calculation in the FTP handler. The problem is limited to leaking a few bytes of data content from the kernel memory area or the natd process. CVE-2019-15879
• — a vulnerability in the cryptodev module, caused by accessing already freed memory (use-after-free), allowing an unprivileged process to overwrite arbitrary sections of kernel memory. As a workaround to mitigate the vulnerability, it is recommended to unload the cryptodev module using the command 'kldunload cryptodev' if it has been loaded (by default, cryptodev is not loaded). The cryptodev module provides applications from user space with access to the /dev/crypto interface for accessing hardware acceleration mechanisms for cryptographic operations (AES-NI and OpenSSL do not use /dev/crypto). CVE-2019-15880
• CVE-2019-15880 — the second vulnerability in cryptodev, allowing an unprivileged user to cause a kernel crash by sending a request to perform a cryptographic operation with an incorrect MAC. The issue is caused by the lack of a MAC key size check when allocating a buffer for its storage (the buffer was created based on the user-provided size information, without verifying the actual size).
• CVE-2019-15878 — a vulnerability in the implementation of the SCTP (Stream Control Transmission Protocol), caused by improper checking of the shared key used by the SCTP-AUTH extension for authenticating SCTP sequences. A local application can update the key via the Socket API while simultaneously interrupting the SCTP connection, leading to access to an already freed memory area (use-after-free).

Source: opennet.ru