Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-7460

In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.

Published

2020-08-06T17:15:11.317

Last Modified

2024-11-21T05:37:11.337

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.0 (HIGH)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.4

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.3 Yes
Operating System freebsd freebsd 11.4 Yes
Operating System freebsd freebsd 11.4 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System freebsd freebsd 12.1 Yes
References