← Back

CVE-2020-7460

nvd nist
Published: Aug 6, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.0
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD

Description

In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.

Affected (21)

Products: Freebsd: Freebsd
Freebsd
1 product
Freebsd
Configuration A
21 vulnerable
Vulnerable SoftwareAffected Versions
Freebsd
Freebsd
Version 11.3
Freebsd
Version 11.3 p10
Freebsd
Version 11.3 p11
Freebsd
Version 11.3 p1
Freebsd
Version 11.3 p2
Freebsd
Version 11.3 p3
Freebsd
Version 11.3 p4
Freebsd
Version 11.3 p5
Freebsd
Version 11.3 p6
Freebsd
Version 11.3 p7
Freebsd
Version 11.3 p8
Freebsd
Version 11.3 p9
Freebsd
Version 11.4
Freebsd
Version 11.4 p1
Freebsd
Version 12.1
Freebsd
Version 12.1 p1
Freebsd
Version 12.1 p2
Freebsd
Version 12.1 p3
Freebsd
Version 12.1 p4
Freebsd
Version 12.1 p6
Freebsd
Version 12.1 p7

Related CWEs

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (6)

Source: secteam@freebsd.org
Vendor Advisory
Source: secteam@freebsd.org
Third Party Advisory
Source: secteam@freebsd.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry

Timeline

No history available yet.