The Stack Buffer Overflow vulnerability, tracked as CVE-2022-23093, is caused by a boundary error in the ping module’s pr_pack() function and affects all supported versions of FreeBSD. The ping module allows testing the accessibility of a remote host using ICMP messages and reads raw IP packets to process responses in the pr_pack() function. The pr_pack() function copies the received IP and ICMP headers to the stack buffers for further processing. A remote threat actor could exploit this vulnerability to trigger a boundary fault, crash the ping program, and execute code remotely on the affected system.
There has yet to be an update that fixes the vulnerability. In this context, in order not to be the target of attacks that can be carried out using the vulnerability, it is recommended that the updates to be published should be implemented immediately if they are followed and published.
