dbcve.org
FreeBSDOperating system

CVE-2022-23093

MEDIUM · 6.5 CVSS v3.1 Published 2024-02-15
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
71/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

The FreeBSD ping utility's pr_pack() function contains a buffer overflow vulnerability when processing ICMP responses. The function copies IP and ICMP headers into fixed-size stack buffers without accounting for optional IP header extensions that may follow the standard IP header, allowing up to 40 bytes of overflow when such options are present. A remote attacker can trigger this by sending specially crafted ICMP responses containing IP options, causing the ping process to crash.

MitigationApply the vendor patch for CVE-2022-23093 when available, or update the FreeBSD system packages to receive the corrected ping binary. As a defense-in-depth measure, the capability mode sandbox already in place limits the impact of successful exploitation.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
FreeBSDOperating system
Affected:= 12.3= 12.4= 13.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check FreeBSD OS version
    Run 'uname -r' or 'freebsd-version' to determine the installed FreeBSD release version
    Affected if Version shows 12.3, 12.4, or 13.1 (these specific releases contain the vulnerable ping binary)
  2. Check installed ping binary version
    Run 'ping -v' or '/sbin/ping -v' to display the ping utility version
    Affected if The ping version corresponds to an unpatched FreeBSD 12.3, 12.4, or 13.1 release
  3. Verify ping package update status
    Run 'pkg info ping' or 'pkg version -v | grep ping' to check if the ping package has been updated
    Affected if The ping package shows as out-of-date or has a version predating the security fix for CVE-2022-23093

System is affected if running FreeBSD 12.3, 12.4, or 13.1 with a ping binary that has not received the security patch for CVE-2022-23093 (the buffer overflow in pr_pack when processing ICMP responses with IP header options).

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the vendor patch for CVE-2022-23093 when available, or update the FreeBSD system packages to receive the corrected ping binary. As a defense-in-depth measure, the capability mode sandbox already in place limits the impact of successful exploitation.

Recommended fix Moderate confidence

FreeBSD 13.2 or later stable branch (or the latest patch level of 12.4+ with security patches applied)

  1. 1. Identify the current FreeBSD version using 'freebsd-version' or 'uname -a'
  2. 2. Check for available FreeBSD security advisory (FreeBSD-SA-22:02) for this CVE at security.freebsd.org
  3. 3. Apply system updates: run 'freebsd-update fetch' followed by 'freebsd-update install'
  4. 4. Alternatively, upgrade to a newer FreeBSD release (13.2 or later) that contains the patched ping binary
  5. 5. After update/upgade, verify ping version with 'ping -v' to confirm the fix is applied
  6. 6. Test ping functionality to ensure proper operation
Caveat Upgrading FreeBSD base system carries standard upgrade risks; ensure backups and test in staging before production deployment. The ping binary itself has no breaking changes from this fix.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in FreeBSD Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing8.0 h
  • Review / QA4.0 h
30.0 hours of engineering $5,280
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-23093 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-23093 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data