CVE-2020-7457
HIGHFreeBSD ip6_setpktopt Use-After-Free Privilege Escalation
Title source: metasploitExploitation Summary
EIP tracks 1 public exploit for CVE-2020-7457.
PoCs published by Andy Nguyen, bcoles, including Metasploit module exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a use-after-free vulnerability in FreeBSD's IPv6 socket handling (CVE-2020-7457) to achieve local privilege escalation. It races `ip6_setpktopt` access to a freed `ip6_pktopts` struct, enabling arbitrary kernel read/write for privilege escalation.
Description
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.
Exploits (1)
This Metasploit module exploits a use-after-free vulnerability in FreeBSD's IPv6 socket handling (CVE-2020-7457) to achieve local privilege escalation. It races `ip6_setpktopt` access to a freed `ip6_pktopts` struct, enabling arbitrary kernel read/write for privilege escalation.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H