The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jails primary IPv6 address.
A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the hosts IPv6 loopback address, bypassing jail network isolation.
Weakness
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freebsd | Freebsd | 14.4 (including) | 14.4 (including) |
| Freebsd | Freebsd | 14.4-p1 (including) | 14.4-p1 (including) |
| Freebsd | Freebsd | 14.4-p2 (including) | 14.4-p2 (including) |
| Freebsd | Freebsd | 14.4-p3 (including) | 14.4-p3 (including) |
| Freebsd | Freebsd | 14.4-p4 (including) | 14.4-p4 (including) |
| Freebsd | Freebsd | 14.4-p5 (including) | 14.4-p5 (including) |
| Freebsd | Freebsd | 14.4-p6 (including) | 14.4-p6 (including) |
| Freebsd | Freebsd | 14.4-p7 (including) | 14.4-p7 (including) |
| Freebsd | Freebsd | 14.4-p8 (including) | 14.4-p8 (including) |
| Freebsd | Freebsd | 14.4-p9 (including) | 14.4-p9 (including) |
| Freebsd | Freebsd | 14.5 (including) | 14.5 (including) |
| Freebsd | Freebsd | 15.0 (including) | 15.0 (including) |
| Freebsd | Freebsd | 15.0-p1 (including) | 15.0-p1 (including) |
| Freebsd | Freebsd | 15.0-p10 (including) | 15.0-p10 (including) |
| Freebsd | Freebsd | 15.0-p11 (including) | 15.0-p11 (including) |
| Freebsd | Freebsd | 15.0-p12 (including) | 15.0-p12 (including) |
| Freebsd | Freebsd | 15.0-p13 (including) | 15.0-p13 (including) |
| Freebsd | Freebsd | 15.0-p2 (including) | 15.0-p2 (including) |
| Freebsd | Freebsd | 15.0-p3 (including) | 15.0-p3 (including) |
| Freebsd | Freebsd | 15.0-p4 (including) | 15.0-p4 (including) |
| Freebsd | Freebsd | 15.0-p5 (including) | 15.0-p5 (including) |
| Freebsd | Freebsd | 15.0-p6 (including) | 15.0-p6 (including) |
| Freebsd | Freebsd | 15.0-p7 (including) | 15.0-p7 (including) |
| Freebsd | Freebsd | 15.0-p8 (including) | 15.0-p8 (including) |
| Freebsd | Freebsd | 15.0-p9 (including) | 15.0-p9 (including) |
| Freebsd | Freebsd | 15.1 (including) | 15.1 (including) |
| Freebsd | Freebsd | 15.1-p1 (including) | 15.1-p1 (including) |
| Freebsd | Freebsd | 15.1-p2 (including) | 15.1-p2 (including) |
| Freebsd | Freebsd | 15.1-p3 (including) | 15.1-p3 (including) |
Extended Description
Attackers at the destination may be able to spoof trusted servers to steal data or cause a denial of service. There are at least two distinct weaknesses that can cause the product to communicate with an unintended destination: