PT-2016-1730 · Freebsd · Freebsd

Francisco Falcon + 1 · Publicado 2016-04-08 · Atualizado 2018-10-09 · CVE-2016-1885

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.3 before p39 FreeBSD versions 10.1 before p31 FreeBSD versions 10.2 before p14

Description The issue is caused by an integer signedness error in the amd64 set ldt function, located in sys/amd64/amd64/sys machdep.c, which leads to a heap-based buffer overflow. This can be exploited by a local attacker using the i386 set ldt system call, resulting in a denial of service (kernel panic).

Recommendations For FreeBSD version 9.3, update to p39 or later. For FreeBSD version 10.1, update to p31 or later. For FreeBSD version 10.2, update to p14 or later.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-01056

CVE-2016-1885

FREEBSD-SA-16_15

Produtos afetados

Freebsd

Referências · 14

• 🔥 https://exploit-db.com/exploits/39570 · Exploit
• 🔥 http://packetstormsecurity.com/files/136276/FreeBSD-Kernel-amd64_set_ldt-Heap-Overflow.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-1885 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-01056 · Nota de Segurança
• http://securitytracker.com/id/1035309 · Nota
• http://securityfocus.com/archive/1/archive/1/537812/100/0/threaded · Nota
• https://security.freebsd.org/advisories/FreeBSD-SA-16:15.sysarch.asc · Aviso do Fabricante
• http://securityfocus.com/archive/1/537813/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/Mar/67 · Nota
• https://osv.dev/vulnerability/CVE-2016-1885 · Aviso do Fabricante
• http://coresecurity.com/advisories/freebsd-kernel-amd64setldt-heap-overflow · Nota
• http://securityfocus.com/archive/1/537812/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/Mar/56 · Nota
• http://securityfocus.com/archive/1/archive/1/537813/100/0/threaded · Nota