Description
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FreeBSD | FreeBSD 12.1-RELEASE before p7, 11.4-RELEASE before p1, 11.3-RELEASE before p11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation
exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.