Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-7457

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.

Published

2020-07-09T14:15:10.917

Last Modified

2024-11-21T05:37:10.960

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-362
    CWE-416
    CWE-662
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.4 Yes
Operating System freebsd freebsd 11.4 Yes
Operating System freebsd freebsd 11.4 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
References