-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-20:32.rtsold Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in rtsold
Category: core
Module: rtsold
Announced: 2020-12-01
Credits: Francisco Falcon at Quarkslab
Affects: All supported versions of FreeBSD
Corrected: 2020-12-01 19:35:48 UTC (stable/12, 12.2-STABLE)
2020-12-01 19:39:44 UTC (releng/12.2, 12.2-RELEASE-p1)
2020-12-01 19:39:44 UTC (releng/12.1, 12.1-RELEASE-p11)
2020-12-01 19:36:37 UTC (stable/11, 11.4-STABLE)
2020-12-01 19:39:44 UTC (releng/11.4, 11.4-RELEASE-p5)
CVE Name: CVE-2020-25577, CVE-2020-25583
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
0. Revision History
v1.0 2020-12-01 Initial release.
v1.1 2021-03-29 Allocate additional CVE. Update credit. Add reference.
I. Background
As part of the stateless address autoconfiguration (SLAAC) mechanism, IPv6
routers periodically broadcast router advertisement messages on attached
networks to inform hosts of the correct network prefix, router address and
MTU, as well as additional network parameters such as the DNS servers
(RDNSS), DNS search list (DNSSL) and whether a stateful configuration service
is available. Hosts that have recently joined the network can broadcast a
router solicitation message to solicit an immediate advertisement instead of
waiting for the next periodic advertisement.
The router solicitation daemon, rtsold(8), broadcasts router solicitation
messages at startup or when the state of an interface changes from passive to
active. Incoming router advertisement messages are first processed by the
kernel and then passed on to rtsold(8), which handles the DNS and stateful
configuration options.
II. Problem Description
Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling. First,
rtsold(8) failed to perform sufficient bounds checking on the extent of the
option. In particular, it does not verify that the option does not extend
past the end of the received packet before processing its contents. The
kernel currently ignores such malformed packets but still passes them to
userspace programs. [CVE-2020-25577]
Second, when processing a DNSSL option, rtsold(8) decodes domain name labels
per an encoding specified in RFC 1035 in which the first octet of each label
contains the label's length. rtsold(8) did not validate label lengths
correctly and could overflow the destination buffer. [CVE-2020-25583]
III. Impact
It is believed that these bugs could be exploited to gain remote code
execution within the rtsold(8) daemon, which runs as root. Note that
rtsold(8) only processes messages received from hosts attached to the same
physical link as the interface(s) on which rtsold(8) is listening.
In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the scope of a
compromised rtsold(8) process.
IV. Workaround
No workaround is available, but systems that do not run rtsold(8) are not
affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch
# fetch https://security.FreeBSD.org/patches/SA-20:32/rtsold.patch.asc
# gpg --verify rtsold.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in .
Restart the applicable daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368250
releng/12.2/ r368256
releng/12.1/ r368256
stable/11/ r368253
releng/11.4/ r368256
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmBiOjsACgkQ05eS9J6n
5cIOOw/+PJ9oQKIETOcfG7z+eSlOc8Q76oR2KViyD0v5Es2IBVOAGM6SV8InnN30
I7Qn4C5z9J1BKysYZZeVrN2XI9n7HhYH5gOUGDSX0atImJJVsYYxT6Guf4+iq3xF
OWQw/MWJE7Pv74y1Fu0qOYRDAYU+YUtXqRZxtiGvm3vAz+jFeYSPAjyBt2g7Sn/w
5MA6GicsokCBAR2qdpFpU1OBbWiyBRUHLgLRcXeYTCL9ijMfcayT5tsN69Uwfpmv
CY2UtheOEwAgxyfVg1RHKIup9nwVuu0zvr/kYDObJS9AphScquV/fHWObX2LwKIQ
7ogxnhM7Awa/JqepIp2v5uDerKkzQvXn8JOwi1v/blkxxVWBi0m7UEbKEebGT1pW
uohN7rpOa95SBvnITFHbxdU8uHSCL6sXf0qXp03QpJtccQ5MWYP/NROGGQXJRa+v
rquIYFJ8vEGPWItBgPEsYm918gUKftgV7ZLeFOz1QG5ZOYOMAVSf6411nb63W/Bm
ml3N7KAxwY8X9YST/1pPUqLXwtIEHRIG1o6qTrkCf2rSSiQdLwyBbfoOlY+iQd/m
ko7NnkpA3zgtnB/qBtgZ1hVAkI3qe0w4ItbWyUN/obLHbWDH5V40fXGfoJ4H0zpw
j1OV34N7TL7Q5GoHnrLFcxzjwlmHfPP2ko/6kGuBUg8dzK9zLfQ=
=VerZ
-----END PGP SIGNATURE-----