CVE-2020-7469

In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a routing option caches a pointer into the packet buffer holding the ICMPv6 message. However, when processing subsequent options the packet...

CVE-2020-7469

The CVE-2020-7469 issue affects FreeBSD’s ICMPv6 handling: the routing option handler caches a pointer to a packet buffer containing an ICMPv6 message, which can be freed later, risking a use-after-free when the pointer is dereferenced. A remote attacker could trigger a read of freed kernel memor...