CVE-2020-7451: 
vSphere ESXi Hypervisor vulnerability analysis and mitigation

In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE-p7, a TCP SYN-ACK or challenge TCP-ACK segment over IPv6 that is transmitted or retransmitted does not properly initialize the Traffic Class field, potentially disclosing one byte of kernel memory over the network (FreeBSD Advisory, CVE Mitre).

The vulnerability exists in the IPv6 header's Traffic Class field, which contains one byte of data. This field includes two bits for Explicit Congestion Notification (ECN) and six bits for Differentiated Services Field Codepoints (DSCP). The issue occurs during TCP connection setup for servers, specifically when handling TCP SYN-ACK segments or challenge ACK segments in response to received RST segments. When a TCP server transmits or retransmits these segments over IPv6, the Traffic Class field is left uninitialized (FreeBSD Advisory).

For each TCP SYN-ACK or challenge TCP-ACK segment sent over IPv6, one byte of kernel memory is exposed and transmitted over the network. This information disclosure could potentially reveal sensitive system information to attackers (FreeBSD Advisory).

The vulnerability affects all systems using IPv6 on the affected FreeBSD versions. Systems not using IPv6 are unaffected. The issue can be triggered during normal TCP connection establishment processes (FreeBSD Advisory).

The vulnerability was corrected in FreeBSD versions after March 8, 2020. Users should upgrade to supported FreeBSD stable or release/security branch dated after the correction date and reboot their systems. The fix can be applied either through a binary patch using the freebsd-update utility or by applying a source code patch and recompiling the kernel (FreeBSD Advisory).