CVE-2020-7464 (GCVE-0-2020-7464)

Vulnerability from cvelistv5 – Published: 2021-03-26 20:55 – Updated: 2024-08-04 09:33
VLAI
Summary
In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret part of the payload of a large packet as a separate packet, and thereby inject packets across security boundaries such as VLANs.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Improper Calculation of Buffer Size
Assigner
References
Impacted products
Vendor Product Version
n/a FreeBSD Affected: FreeBSD 12.1-RELEASE before p10, 11.4-RELEASE before p4, 11.3-RELEASE before p14
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:33:18.651Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeBSD",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "FreeBSD 12.1-RELEASE before p10, 11.4-RELEASE before p4, 11.3-RELEASE before p14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret part of the payload of a large packet as a separate packet, and thereby inject packets across security boundaries such as VLANs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Calculation of Buffer Size",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-26T20:55:25.000Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secteam@freebsd.org",
          "ID": "CVE-2020-7464",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "FreeBSD",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "FreeBSD 12.1-RELEASE before p10, 11.4-RELEASE before p4, 11.3-RELEASE before p14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret part of the payload of a large packet as a separate packet, and thereby inject packets across security boundaries such as VLANs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Calculation of Buffer Size"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc",
              "refsource": "MISC",
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2020-7464",
    "datePublished": "2021-03-26T20:55:25.000Z",
    "dateReserved": "2020-01-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T09:33:18.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-7464",
      "date": "2026-06-29",
      "epss": "0.00737",
      "percentile": "0.49871"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-7464\",\"sourceIdentifier\":\"secteam@freebsd.org\",\"published\":\"2021-03-26T21:15:13.257\",\"lastModified\":\"2024-11-21T05:37:11.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret part of the payload of a large packet as a separate packet, and thereby inject packets across security boundaries such as VLANs.\"},{\"lang\":\"es\",\"value\":\"En FreeBSD versiones 12.2-STABLE anteriores a r365730, 11.4-STABLE anteriores a r365738, 12.1-RELEASE anteriores a p10, 11.4-RELEASE anteriores a p4 y 11.3-RELEASE anteriores a p14, un error de programaci\u00f3n en el controlador de dispositivo ure(4) caus\u00f3 que algunas interfaces Realtek USB Ethernet reportaran incorrectamente paquetes con m\u00e1s de 2048 bytes en una sola transferencia USB con una longitud de solo 2048 bytes.\u0026#xa0;Un adversario puede explotar esto para causar que el controlador interprete inapropiadamente parte de la carga \u00fatil de un paquete grande como un paquete separado y, por lo tanto, inyectar paquetes a trav\u00e9s de  los l\u00edmites de seguridad, como las VLAN.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F35957CE-AF9F-40CA-BDD1-FA6A0E73783F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA929713-B797-494A-853D-C121D9D69519\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p10:*:*:*:*:*:*\",\"matchCriteriaId\":\"B87AF171-95AC-4DDA-8D94-694F85638B46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p11:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CC8B031-41BB-4846-B092-7E4BC6F35D6B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p12:*:*:*:*:*:*\",\"matchCriteriaId\":\"83E34012-BC9D-4F0C-AAE1-FE5767B4EED6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p13:*:*:*:*:*:*\",\"matchCriteriaId\":\"57EF03AC-0934-46FD-A77C-76A0CAF4342C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C3D8EDC-91D3-45B2-AC1D-EF4346D4A714\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA5006FF-06A5-4D95-BF5B-29F26248D11F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A705031B-FD63-4076-B92E-E826E11D7111\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"11C1EFB1-68E5-45F4-A7E1-744574F290D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"25F649A7-9265-4552-8934-BCE083363982\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F202C856-5B95-4796-AC4A-1F210E7BAB8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"9419C866-C478-4CDE-A9A1-E592D8FF0933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.3:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B6DFC23-A7A1-431A-9AD9-A820579F95F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A865EA1-01D7-4E5A-9D13-80780F8A9D7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.4:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FCA6A72-2A72-45FD-A43D-B5BF7C329121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.4:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"90F9B3CB-3B60-4AA8-9EAF-4F0BE7D27691\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:11.4:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C04EE177-C7D1-4049-B680-F961A27C677F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD730B6A-F123-4685-ACB3-4F20AAAB77F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"508150E3-2C0C-4EEB-BFC9-BB5CEB404C06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5D692EF-A5D7-430E-91BA-4CD137343B66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D50C60A7-4C9F-4636-92E9-9F5B8B01BE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C49F6C7-A740-42F4-93BB-512CBF334516\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"402740C4-5B55-423F-BAD2-F742E1E21ADC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DCAA10A-C612-45E0-84B7-55897F49D65E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB6258A5-8066-48B8-A417-09A1547DD57A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6601C7C4-EC36-4EAA-90AC-D3156A2BF330\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDCBC06C-B16B-498A-A99B-5F9F17C5FF03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"73D9C08B-8F5B-40C4-A5BD-B00D2E4C012D\"}]}]}],\"references\":[{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc\",\"source\":\"secteam@freebsd.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.