CVE-2020-7461

In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.

Affected

FreeBSD

CVSS v3.1 NVD

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.13% chance of exploitation in the next 30 days, 91st percentile

Published

2021-03-26

Updated

2024-08-04

Proof-of-concept exploits (2)

• 0xkol/freebsd-dhclient-poc1★ · 2022-11-30
• knqyf263/CVE-2020-746115★ · 2021-04-14

Security advisories

• https://security.FreeBSD.org/advisories/FreeBSD-SA-20:26.dhclient.asc
• https://cert-portal.siemens.com/productcert/pdf/ssa-288459.pdf

References

• CVE Record
• NVD entry

Related

• CVE-2020-11896
• CVE-2022-20421
• CVE-2015-5477
• CVE-2018-1111
• CVE-2018-11235
• CVE-2018-11776