Description
In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does not verify that the RDNSS option does not extend past the end of the received packet before processing its contents. While the kernel currently ignores such malformed packets, it passes them to userspace programs. Any programs expecting the kernel to do validation may be vulnerable to an overflow.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210423-0001/
Scores
CVSS v3
9.8
EPSS
0.0058
EPSS Percentile
69.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-120
Status
published
Products (3)
freebsd/freebsd
11.4 (4 CPE variants)
freebsd/freebsd
12.1 (10 CPE variants)
freebsd/freebsd
12.2
Published
Mar 29, 2021
Tracked Since
Feb 18, 2026