A critical vulnerability in the implementation of the ping command on FreeBSD family systems has been a hot topic recently. The vulnerability was classified as CVE-2022-23093 and it exploits the way the ping command processes the IP and ICMP headers of the Echo Reply, resulting in a stack buffer overflow. Such an action can subsequently led to the suspension of the ping process, as well as remote code execution (RCE).
According to the information published by the team responsible for the FreeBSD system, the ping process there operates within an isolated environment (the so-called capability mode sandbox), which limits its ability to communicate with other system components. This, according to the FreeBSD project team, is supposed to limit the impact of possible exploitation of the vulnerability. The vulnerability exists in FreeBSD versions 12 and 13 and has already been patched in the latest versions of the system (13.1 and 12.4).
Source:
FreeBSD
Ping of death! FreeBSD fixes crashtastic bug in network tool
CVE-2022-23093 FreeBSD vulnerability allows remote execution of malware on devices including PlayStation, WhatsApp etc
