CVE-2020-25583 Memory corruption in FreeBSD
A buffer overflow in FreeBSD's rtsold allows attackers to execute arbitrary code or cause a denial of service via crafted DNSSL options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25583?
CVE-2020-25583 is a critical memory corruption vulnerability in Freebsd Freebsd, published on 29 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a DNSSL option, rtsold(8) decodes domain name labels per an encoding specified in RFC 1035 in which the first octet of each label contains the label's length. rtsold(8) did not validate label lengths correctly and could overflow the destination buffer.
Weakness: CWE-120
Which versions are affected by CVE-2020-25583?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2020-25583?
No fix has been published for CVE-2020-25583 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-25583 being exploited?
There is no known exploitation of CVE-2020-25583 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-972m-7j39-p3qp.