FreeBSD up to 11.4/12.1 on 64-bit compat32 Subsystem Message Header toctou

Summaryinfo

A vulnerability was found in FreeBSD up to 11.4/12.1 on 64-bit. It has been classified as problematic. Affected is an unknown function of the component compat32 Subsystem. This manipulation as part of Message Header causes toctou. This vulnerability is tracked as CVE-2020-7460. The attack is restricted to local execution. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability has been found in FreeBSD up to 11.4/12.1 on 64-bit (Operating System) and classified as critical. Affected by this vulnerability is an unknown code block of the component compat32 Subsystem. The manipulation as part of a Message Header leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.

The weakness was disclosed 08/06/2020 (Website). It is possible to read the advisory at security.FreeBSD.org. This vulnerability is known as CVE-2020-7460 since 01/21/2020. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem.

The entry VDB-159366 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 12.0
• 12.1

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion