CVE-2020-25577

    Dashboard / Vulnerabilities / CVE-2020-25577

    CVE-2020-25577

    Published: 29 Mar 2021Last Modified: 24 Feb 2026

    Summary:

    Details: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does not verify that the RDNSS option does not extend past the end of the received packet before processing its contents. While the kernel currently ignores such malformed packets, it passes them to userspace programs. Any programs expecting the kernel to do validation may be vulnerable to an overflow.

    References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc, https://security.netapp.com/advisory/ntap-20210423-0001/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a344d02bf3aef5d00d8b41eb9c8a0cb1ca4a1a9c

    Affected versions

    vendor/FreeBSD/dist/10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-25577 | CVE-DB