CVE-2020-7463

CWE-416 — Use After Free6 documents5 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 84.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Apple IcloudApple IpadosApple Iphone OS+6 more
Timeline
PublishedMar 26
Latest updateMay 24

Description

In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5freebsdFreeBSD 12.1-RELEASE before p9, 11.4-RELEASE before p3, 11.3-RELEASE before p13
▶NVDapple/tvos< 14.5
▶NVDapple/macos11.0 — 11.3
▶NVDapple/icloud< 12.3
▶NVDapple/ipados< 14.5

Also affects: Freebsd 11.3, 11.4, 12.1, 12.2

🔴Vulnerability Details

2
GHSA
GHSA-j8c4-54pw-h2vw: In FreeBSD 12↗2022-05-24
▶
CVEList
CVE-2020-7463: In FreeBSD 12↗2021-03-26
▶

📋Vendor Advisories

3
Apple
CVE-2020-7463: iOS 14.5 and iPadOS 14.5↗2021-04-26
▶
Apple
CVE-2020-7463: macOS Big Sur 11.3↗2021-04-26
▶
BSD
FreeBSD-SA-20:25.sctp: SCTP socket use-after-free bug↗2020-09-02
▶
CVE-2020-7463 (MEDIUM CVSS 5.5) | In FreeBSD 12.1-STABLE before r3646 | cvebase.io