In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before…

published 2020-07-09 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28583

cvss: 8.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 33.1%; EPSS 33.1% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Metasploit

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.

Patch / fix

links 1

security.freebsd.org/advisories/FreeBSD-SA-20:20.ipv6.asc advisory

Timeline

2020-07-07 First public exploit (Metasploit exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc)
2020-07-09 Published

Exploit prediction

33.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation metasploit exploit, great rank, 2020-07-07
packetstormsecurity.com http://packetstormsecurity.com/files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

n/a FreeBSD

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
CWE-416 Use After Free
CWE-662 Improper Synchronization

References

security.freebsd.org /advisories/FreeBSD-SA-20:20.ipv6.asc
patch, vendor-advisory
packetstormsecurity.com /files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html
exploit, third-party-advisory, vdb-entry
security.netapp.com /advisory/ntap-20200724-0002/
third-party-advisory

Sources

CVE List CVE-2020-7457
NVD CVE-2020-7457

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary