Dragonflybsd
Monthly
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.
Kernel memory disclosure in DragonFly BSD through 6.4.2 (prior to commit 4bb22ff) allows an unauthenticated attacker on the adjacent Layer-2 broadcast domain to leak roughly 250 bytes each of kernel heap and stack memory - including kernel pointers - with a single crafted ARP request. The ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields, and in_arpreply() subsequently uses those attacker-controlled values as memcpy lengths against kernel buffers that are only 6 and 4 bytes long, copying the overread bytes back to the requester in the ARP reply. No authentication or user interaction is required, but impact is confined to adjacent-network attackers because ARP is not routed across subnets, and no public exploit code has been identified at time of analysis.