Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems

Dec 05, 2022Ravie Lakshmanan

The maintainers of the FreeBSD operating system have released
updates to remediate a security vulnerability impacting the ping
module that could be potentially exploited to crash the program or
trigger remote code execution.

The issue, assigned the identifier
CVE-2022-23093, impacts all supported versions of
FreeBSD and concerns a stack-based buffer overflow^[1] vulnerability in the
ping service^[2].

“ping reads raw IP packets from the network to process responses
in the pr_pack() function,” according to an advisory^[3]
published last week.

“The pr_pack() copies received IP and ICMP^[4]
headers into stack buffers for further processing. In so doing, it
fails to take into account the possible presence of IP option
headers following the IP header in either the response or the
quoted packet.”

As a consequence, the destination buffer could be overflowed by
up to 40 bytes when the IP option headers are present.

The FreeBSD Project noted that the ping process runs in a
capability mode sandbox^[5]
and is therefore constrained in how it can interact with the rest
of the operating system.

OPNsense, an open source, FreeBSD-based firewall and routing
software, has also released a patch^[6]
(version 22.7.9) to plug the security hole, along with other
issues.

The findings come as researchers from Qualys detailed another
new vulnerability^[7]
in the snap-confine program in the Linux operating system, building
upon a previous privilege escalation flaw (CVE-2021-44731^[8]) that came to light in
February 2022.

Snaps are self-contained application packages that can be
distributed by upstream developers to users.

The new shortcoming (CVE-2022-3328), introduced as part of a
patch for CVE-2021-44731, can be chained with two other flaws in
multipathd^[9]
called Leeloo Multipath^[10] – an authorization
bypass and a symlink attack tracked as CVE-2022-41974 and
CVE-2022-41973 – to gain root privileges.

Since the multipathd daemon runs by default as root, a
successful exploitation of the flaws could enable an unprivileged
threat actor to obtain the highest permissions on the vulnerable
host and execute arbitrary code.