The implementation of lib9p’s handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.

A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause.

When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.

When pam_exec(8) is used for authentication with the expose_authtok option and an application calls pam_setcred(3), it attempts to expose an already stored authentication token. It is incorrectly assumed that there always is such a token stored, which leads to dereferencing a NULL pointer if this isn’t the case.

When a CAM-managed device responds to a command with an error condition, CAM may automatically retry the command following some error recovery protocol.

In FreeBSD 13.1, periodic events of type EVFILT_TIMER will return at only half of the requested frequency, following the first event.

Under certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory.

Operations specific to TLB invalidation in PCID mode were misordered with respect to IPI transmission.

A Hyper-V vPCI emulation change can cause SR-IOV (Single-Root I/O Virtualization) and DDA (Discrete Device Assignment) devices to fail to operate correctly under Hyper-V.

The hard-coded size for state region 1 (SSE/XMM) was incorrect, effectively filling the xmm8 through xmm15 registers with arbitrary values on signal return when the init optimization occurred.

An error during driver initialization results in a kernel panic due to unallocated resources being freed up.

Several certificates were removed from the bundle after the latest release of FreeBSD 12.2 and FreeBSD 13.0.

There are two issues fixed in this security advisory: CVE-2021-23840 & CVE-2021-23841

There are two issues fixed in this security advisory: CVE-2021-3711 & CVE-2021-3712

The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes.

The ggatec(8) daemon does not validate the size of a response before writing it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).

Certain VirtIO-based device models failed to handle errors when fetching I/O descriptors.

When a RHEL 8.4 and later (or variants) are installed as guests within bhyve(8) on emulated NVMe storage, the system will not boot due to a newer UEFI driver that is included with these distributions.

New API functions added in OpenSSL 1.1.1e and later were not publicly exported to applications.

A programming error in the Linux compatibility layer futex(2) system call might allow attackers to cause a denial of service

libcasper(3) allows Capsicum-sandboxed applications to define and use system interfaces which are ordinarily disallowed. It is used by multiple programs in the base system, such as logger(1).

The patch for FreeBSD-SA-21:12.libradius modified rad_get_attr(3) to verify that an attribute length smaller than the minimum required for the attribute type and length fields is disallowed.

libradius did not perform sufficient validation of received messages.

The FreeBSD kernel enables SMAP during boot when the CPU reports that the SMAP capability is present. Subroutines such as copyin() and copyout() are responsible for disabling SMAP around the sections of code that perform user memory accesses.

Two problems are fixed by this update. First, the pms(4) driver did not correctly handle the new kern.maxphys value set in FreeBSD 13.0. Second, the pms(4) driver did not correctly handle some error cases in the I/O path and would falsely report success to upper layers.

The FreeBSD kernel enables SMAP during boot when the CPU reports that the SMAP capability is present. Subroutines such as copyin() and copyout() are responsible for disabling SMAP around the sections of code that perform user memory accesses.

Due to a race condition between lookup of “..” and remounting a filesystem, a process running inside a jail might access filesystem hierarchy outside of jail.

An unprivileged process can configure an accept filter on a listening socket.

A particular case of memory sharing is mishandled in the virtual memory system.

The net.pf.request_maxcount sysctl provides an upper bound on the amount of memory used by pf(4) to store various types of state.

When a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed.

Due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes.

A regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.

The existing logic to try and avoid regenerating passwd/login.conf files relies on timestamp comparisons between old and new files, with the caveat that it’s comparing the installed with a timestamp that has been clobbered to do the comparison.

Several certificates were removed from the bundle after the latest release of FreeBSD 12.2.

An interaction between the code which frees the unused portions of the microcode file and the rest of the system can cause boot hangs.

The FreeBSD kernel exports file system directory entries to userspace using the generic “dirent” structure.

A regression in FreeBSD 12.2 causes zfs receive to fail to delete snapshots that have been deleted on the source side.

Insufficient locking in the kernel meant that destroying an epair and a vnet jail at the same time often resulted in panics.

Two bugs exist in rtsold(8)’s RDNSS and DNSSL option handling.

When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack may extract information from the message to hand to upper-layer protocols.

The bug may result in kernel panics under some workloads, typically in the softclock threads.

A regression in FreeBSD 12.2 meant that ipfw(8) fwd commands referencing specific port numbers may configure the firewall incorrectly.

All execve/fexecve system calls in affected versions will be reported as a failure, even upon successful execution.

A ftpd(8) bug in the implementation of the file system sandbox, combined with capabilities available to an authenticated FTP user, can be used to escape the file system restriction configured in ftpchroot(5).

A number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped.

Insufficient access controls (VMCS) allow root users, including those running in a jail, to change these data structures.

A programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes.

dhclient(8) is the default IPv4 DHCP client used on FreeBSD. It is responsible for contacting DHCP servers on a network segment, and for initializing and configuring network interfaces and configuring name resolution based on received information.

The Stream Control Transmission Protocol (SCTP) is a message oriented transport protocol supporting arbitrary large user messages. It can be accessed from applications by using the the socket API.

IPv6 is a network layer supporting Hop-by-Hop options, which can be sent by applications via the socket API. The memory management for packet handling is done using mbufs.

getfsstat(2) is a system call which provides information about mounted filesystems. The kernel provides compatibility system calls for old versions of the interface.

The Linux ABI layer (Linuxulator) allows Linux binaries to be executed on a FreeBSD kernel.