In the ipfw packet filter there are two vulnerabilities in the TCP option parsing code, caused by improper data verification in the processed network packets. The first vulnerability (CVE-2019-5614) may allow access to memory outside the allocated mbuf buffer when processing specially crafted TCP packets, while the second (CVE-2019-15874) can lead to access to already freed memory areas (use-after-free).
An analysis of the applicability of the identified issues for exploitation that could trigger code execution by an attacker was not conducted, but it cannot be ruled out that the vulnerabilities may lead to more than just a kernel crash. The issues have been fixed in updates FreeBSD 11.3-RELEASE-p8 and 12.1-RELEASE-p4 (corrections were made to the stable branches back in December of last year, but it was only recently that it became known that these corrections were related to addressing the vulnerability).
Source: opennet.ru
