CVE-2020-7452

Published: Apr 29, 2020Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: NVD

Description

In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel.

Affected (10)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 11.3
Freebsd Freebsd	Version 11.3 p1
Freebsd Freebsd	Version 11.3 p2
Freebsd Freebsd	Version 11.3 p3
Freebsd Freebsd	Version 11.3 p4
Freebsd Freebsd	Version 11.3 p5
Freebsd Freebsd	Version 11.3 p6
Freebsd Freebsd	Version 12.1
Freebsd Freebsd	Version 12.1 p1
Freebsd Freebsd	Version 12.1 p2

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (2)

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc

Source: secteam@freebsd.org

PatchVendor Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:07.epair.asc

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.