deadsimple BSD Security Advisories and Announcements

FreeBSD Security Advisory FreeBSD-SA-20:32.rtsold

Hash: SHA512

FreeBSD-SA-20:32.rtsold                                     Security Advisory
                                                          The FreeBSD Project

Topic:          Multiple vulnerabilities in rtsold

Category:       core
Module:         rtsold
Announced:      2020-12-01
Credits:        Quarkslab Vulnerability Reports
Affects:        All supported versions of FreeBSD
Corrected:      2020-12-01 19:35:48 UTC (stable/12, 12.2-STABLE)
                2020-12-01 19:39:44 UTC (releng/12.2, 12.2-RELEASE-p1)
                2020-12-01 19:39:44 UTC (releng/12.1, 12.1-RELEASE-p11)
                2020-12-01 19:36:37 UTC (stable/11, 11.4-STABLE)
                2020-12-01 19:39:44 UTC (releng/11.4, 11.4-RELEASE-p5)
CVE Name:       CVE-2020-25577

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:>.

I.   Background

As part of the stateless address autoconfiguration (SLAAC) mechanism, IPv6
routers periodically broadcast router advertisement messages on attached
networks to inform hosts of the correct network prefix, router address and
MTU, as well as additional network parameters such as the DNS servers
(RDNSS), DNS search list (DNSSL) and whether a stateful configuration service
is available.  Hosts that have recently joined the network can broadcast a
router solicitation message to solicit an immediate advertisement instead of
waiting for the next periodic advertisement.

The router solicitation daemon, rtsold(8), broadcasts router solicitation
messages at startup or when the state of an interface changes from passive to
active.  Incoming router advertisement messages are first processed by the
kernel and then passed on to rtsold(8), which handles the DNS and stateful
configuration options.

II.  Problem Description

Two bugs exist in rtsold(8)'s RDNSS and DNSSL option handling.  First,
rtsold(8) failed to perform sufficient bounds checking on the extent of the
option.  In particular, it does not verify that the option does not extend
past the end of the received packet before processing its contents.  The
kernel currently ignores such malformed packets but still passes them to
userspace programs.

Second, when processing a DNSSL option, rtsold(8) decodes domain name labels
per an encoding specified in RFC 1035 in which the first octet of each label
contains the label's length.  rtsold(8) did not validate label lengths
correctly and could overflow the destination buffer.

III. Impact

It is believed that these bugs could be exploited to gain remote code
execution within the rtsold(8) daemon, which runs as root.  Note that
rtsold(8) only processes messages received from hosts attached to the same
physical link as the interface(s) on which rtsold(8) is listening.

In FreeBSD 12.2 rtsold(8) runs in a Capsicum sandbox, limiting the scope of a
compromised rtsold(8) process.

IV.  Workaround

No workaround is available, but systems that do not run rtsold(8) are not

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

Perform one of the following:

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch
# fetch
# gpg --verify rtsold.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:>.

Restart the applicable daemons, or reboot the system.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/12/                                                        r368250
releng/12.2/                                                      r368256
releng/12.1/                                                      r368256
stable/11/                                                        r368253
releng/11.4/                                                      r368256
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://

Or visit the following URL, replacing NNNNNN with the revision number:


VII. References


The latest revision of this advisory is available at

_______________________________________________ mailing list
To unsubscribe, send any mail to ""