FreeBSD kTLS Arbitrary File Overwrite Vulnerability (SA-20:26/CVE-2020-45257)

Vulnerability Overview Vulnerability Name: Arbitrary file overwrite via the kTLS receive path Module: core Advisory Date: 2020-06-09 Affected Versions: All supported FreeBSD versions CVE ID: CVE-2020-45257 Impact Scope Background: The Kernel TLS (kTLS) module supports the processing of Transport Layer Security (TLS) records, allowing applications to encrypt and decrypt socket data without copying it to user space. Problem Description: The kTLS receive path assumes that received data buffers are anonymous and safe to modify. However, when the sender sends file-backed buffers through a loop that has kTLS disabled, these buffers arrive at the receiver's decryption path. This causes decrypted data to overwrite the file-backed buffer directly, rather than a private copy. Impact: Unprivileged local users can overwrite the content of files of their choice by sending data in a loop with kTLS receive enabled. This allows bypassing file flags to write directly to disk, potentially leading to privilege escalation and complete control of the affected system. Remediation 1. Temporary Solution: - Disable kTLS: 2. Long-term Solution: - Upgrade to a supported FreeBSD stable or security branch ( ) and reboot the system after the correction date. - Specific steps: - For FreeBSD 15.0-RELEASE versions installed via base system packages: - For FreeBSD versions installed via binary distribution sets: - For systems updated via source code patches: - Download and verify the patch: - Apply the patch: - Recompile the kernel and reboot the system. Additional Information Reference Links: - CVE Record - Latest Revision POC Code / Exploit Code No specific POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD kTLS Arbitrary File Overwrite Vulnerability (SA-20:26/CVE-2020-45257)