-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-20:32.rtsold Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in rtsold
Category: core
Module: rtsold
Announced: 2020-12-01
Credits: Quarkslab Vulnerability Reports
Affects: All supported versions of FreeBSD
Corrected: 2020-12-01 19:35:48 UTC (stable/12, 12.2-STABLE)
2020-12-01 19:39:44 UTC (releng/12.2, 12.2-RELEASE-p1)
2020-12-01 19:39:44 UTC (releng/12.1, 12.1-RELEASE-p11)
2020-12-01 19:36:37 UTC (stable/11, 11.4-STABLE)
2020-12-01 19:39:44 UTC (releng/11.4, 11.4-RELEASE-p5)
CVE Name: CVE-2020-25577
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
As part of the stateless address autoconfiguration (SLAAC) mechanism, IPv6
routers periodically broadcast router advertisement messages on attached
networks to inform hosts of the correct network prefix, router address and
MTU, as well as additional network parameters such as the DNS servers
(RDNSS), DNS search list (DNSSL) and whether a stateful configuration service
is available. Hosts that have recently joined the network can broadcast a
router solicitation message to solicit an immediate advertisement instead of
waiting for the next periodic advertisement.
The router solicitation daemon, rtsold(8), broadcasts router solicitation
messages at startup or when the state of an interface changes from passive to
active. Incoming router advertisement messages are first processed by the
kernel and then passed on to rtsold(8), which handles the DNS and stateful
configuration options.
II. Problem Description
Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling. First,
rtsold(8) failed to perform sufficient bounds checking on the extent of the
option. In particular, it does not verify that the option does not extend
past the end of the received packet before processing its contents. The
kernel currently ignores such malformed packets but still passes them to
userspace programs.
Second, when processing a DNSSL option, rtsold(8) decodes domain name labels
per an encoding specified in RFC 1035 in which the first octet of each label
contains the label's length. rtsold(8) did not validate label lengths
correctly and could overflow the destination buffer.
III. Impact
It is believed that these bugs could be exploited to gain remote code
execution within the rtsold(8) daemon, which runs as root. Note that
rtsold(8) only processes messages received from hosts attached to the same
physical link as the interface(s) on which rtsold(8) is listening.
In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the scope of a
compromised rtsold(8) process.
IV. Workaround
No workaround is available, but systems that do not run rtsold(8) are not
affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch.asc
# gpg --verify rtsold.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the applicable daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368250
releng/12.2/ r368256
releng/12.1/ r368256
stable/11/ r368253
releng/11.4/ r368256
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25577>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl/GndZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIUXQ/+K/FAB22beBBiOUDaRMF0n4a/umwvwX2BAy7PsLIzRcYL8ydhvTWPXQnU
KssmRoi0eobczpIYgIqTDNDTI46UErEvfoCBTIiY+uedER77FKxesfnO/9S3owvh
8uP+WCMzZXRfNvIYqEsK43ipm3LL4rDfUNLEdeFj0bLlwEwiTJaXsdLayJ3KpanN
A3ykePDXnQD41BcDcotvzSV6r7o5dbCILI4K4zEOSCAXBP1Du16J/K/aHOWahJ20
Ex6YFg0llH3VkAVE9iGdHLGFqakjobUhm+LzV9ShAkXZqZs3Hx+p8dfM4w7aicCM
f6Nn0rLlb4ZdSmMnbsexoZZwO0v2dQNHd1EEtQD6zjJfey1auJKJLTcLoWXH+3mm
w5eOjjmqdOkab0h224q8jidhgyUm1c8By5H5aZ79y5SpRG0mfuS82Z6uIAf0KKZ3
uIzPswc0YtI30M638ZCKCug3gxwZu4EG7P08/Ab4B0fpyfqqLy6KVsMdH6w64R6+
64twgiVPuM3DpokvTfdcQLp13IHeMJwkpdc/SICyg3NDAFJZMcIe6eqjko5FsNnH
RSjA0SHRKyl303OLR+jUHe64m+LISyNne+fC1VoThbqQ1f5nWX9PlF4VjRu30Wz4
8VcmRCehMT1G1aIEGG74zKDeWDP6+bGeieBU7Pa/jfr/aI88Hw0=
=5tIC
-----END PGP SIGNATURE-----