FKIE_CVE-2022-23093

Vulnerability from fkie_nvd - Published: 2024-02-15 06:15 - Updated: 2026-06-17 04:29
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.
References
secteam@freebsd.orghttps://security.freebsd.org/advisories/FreeBSD-SA-22:15.ping.ascVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.freebsd.org/advisories/FreeBSD-SA-22:15.ping.ascVendor Advisory
Impacted products
Vendor Product Version
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.3
freebsd freebsd 12.4
freebsd freebsd 13.1
freebsd freebsd 13.1
freebsd freebsd 13.1
freebsd freebsd 13.1
freebsd freebsd 13.1
freebsd freebsd 13.1
freebsd freebsd 13.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ping"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p5",
              "status": "affected",
              "version": "13.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p2",
              "status": "affected",
              "version": "12.4-RC2",
              "versionType": "release"
            },
            {
              "lessThan": "p10",
              "status": "affected",
              "version": "12.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "source": "secteam@freebsd.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "E231B24D-5CA9-4107-A819-57EE116AD644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:*",
              "matchCriteriaId": "3B6DCD8A-331E-419F-9253-C4D35C1DF54B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:*",
              "matchCriteriaId": "4578E06C-16C6-435E-9E51-91CB02602355",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:*",
              "matchCriteriaId": "71FA1F6C-7E53-40F8-B9E1-5FD28D5DAADA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:*",
              "matchCriteriaId": "0EC87BCE-17F0-479B-84DC-516C24FBD396",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p5:*:*:*:*:*:*",
              "matchCriteriaId": "620C23ED-400C-438C-8427-94437F12EDAF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p6:*:*:*:*:*:*",
              "matchCriteriaId": "DEE99CB2-0B1E-4FAB-A7FB-C73E3131B0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p7:*:*:*:*:*:*",
              "matchCriteriaId": "987270DD-4E16-4336-8F38-7C1A6C881B7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p8:*:*:*:*:*:*",
              "matchCriteriaId": "A057889D-8EB9-4C37-9381-96011F8498A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p9:*:*:*:*:*:*",
              "matchCriteriaId": "21656E91-D625-45D7-B8A0-9E0DEFB393A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:*",
              "matchCriteriaId": "BA821886-B26B-47A6-ABC9-B8F70CE0ACFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:*",
              "matchCriteriaId": "66364EA4-83B1-4597-8C18-D5633B361A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:*",
              "matchCriteriaId": "EF9292DD-EFB1-4B50-A941-7485D901489F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:*",
              "matchCriteriaId": "EFB18F55-4F5C-4166-9A7E-6F6617179A90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:*",
              "matchCriteriaId": "66E1C269-841F-489A-9A0A-5D145B417E0A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:*",
              "matchCriteriaId": "ECF1B567-F764-45F5-A793-BEA93720F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:*",
              "matchCriteriaId": "DAFE3F33-2C57-4B52-B658-82572607BD8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:*",
              "matchCriteriaId": "B536EE52-ED49-4A85-BC9D-A27828D5A961",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ping reads raw IP packets from the network to process responses in the pr_pack() function.  As part of processing a response ping has to\u00a0reconstruct the IP header, the ICMP header and if present a \"quoted\u00a0packet,\" which represents the packet that generated an ICMP error.  The\u00a0quoted packet again has an IP header and an ICMP header.\n\nThe pr_pack() copies received IP and ICMP headers into stack buffers\u00a0for further processing.  In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet.  When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes.\n\nThe memory safety bugs described above can be triggered by a remote\u00a0host, causing the ping program to crash.\n\nThe ping process runs in a capability mode sandbox on all affected\u00a0versions of FreeBSD and is thus very constrained in how it can interact\u00a0with the rest of the system at the point where the bug can occur."
    },
    {
      "lang": "es",
      "value": "ping lee paquetes IP sin procesar de la red para procesar las respuestas en la funci\u00f3n pr_pack(). Como parte del procesamiento de una respuesta de ping, se debe reconstruir el encabezado IP, el encabezado ICMP y, si est\u00e1 presente, un \"paquete citado\", que representa el paquete que gener\u00f3 un error ICMP. El paquete citado nuevamente tiene un encabezado IP y un encabezado ICMP. pr_pack() copia los encabezados IP e ICMP recibidos en b\u00faferes de pila para su posterior procesamiento. Al hacerlo, no tiene en cuenta la posible presencia de encabezados de opciones de IP despu\u00e9s del encabezado de IP, ya sea en la respuesta o en el paquete citado. Cuando las opciones de IP est\u00e1n presentes, pr_pack() desborda el b\u00fafer de destino hasta en 40 bytes. Los errores de seguridad de la memoria descritos anteriormente pueden ser desencadenados por un host remoto, lo que provoca que el programa ping falle. El proceso de ping se ejecuta en un modo sandbox de capacidad en todas las versiones afectadas de FreeBSD y, por lo tanto, est\u00e1 muy limitado en cuanto a c\u00f3mo puede interactuar con el resto del sistema en el punto donde puede ocurrir el error."
    }
  ],
  "id": "CVE-2022-23093",
  "lastModified": "2026-06-17T04:29:29.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-23093",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-03-14T21:25:53.167040Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-15T06:15:45.240",
  "references": [
    {
      "source": "secteam@freebsd.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:15.ping.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:15.ping.asc"
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.