RCE via ND6 Router Advertisements in FreeBSD

Re:RCE via ND6 Router Advertisements in FreeBSD by bah_humbug on Thursday December 18, 2025 @12:50PM (#46316056)

> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

The fix consists of implementing an XXX present since the code was added:

    /*
     * XXX validate that domain name only contains valid characters
     * for two reasons: 1) correctness, 2) we do not want to pass
     * possible malicious, unescaped characters like `` to a script
     * or program that could be exploited that way.
     */

https://www.freebsd.org/security/patches/SA-25:12/rtsold.pat...

[ Parent | on HN ]

Re:RCE via ND6 Router Advertisements in FreeBSD by jandrese on Thursday December 18, 2025 @01:12PM (#46316336)

It is wild that it was in that state for so long. It probably took just about as long to write that comment as it would have to implement the proper solution.

[ Parent | on HN ]

Re:RCE via ND6 Router Advertisements in FreeBSD by apstls on Thursday December 18, 2025 @03:25PM (#46318171)

grep --include=*.{c,h} -rnw -B3 -A15 'XXX' ./ | claude -p 'Analyze each code snippet and pick the five most concerning, from a security perspective.'

[ Parent | on HN ]