PT-2019-17774 · Freebsd · Freebsd

CVE-2019-5605 · Publicado 2019-07-24 · Atualizado 2023-03-01

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 11.2-RELEASE before 11.2-RELEASE-p12 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p1 FreeBSD versions 11.3-STABLE before r350217

Description The issue is related to insufficient initialization of memory copied to userland in the freebsd32 ioctl interface. This may cause small amounts of kernel memory to be disclosed to userland processes, potentially allowing an attacker to leverage this information to obtain elevated privileges.

Recommendations For FreeBSD versions 11.2-RELEASE before 11.2-RELEASE-p12, update to 11.2-RELEASE-p12 or later. For FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p1, update to 11.3-RELEASE-p1 or later. For FreeBSD versions 11.3-STABLE before r350217, update to r350217 or later.

Correção

Improper Initialization

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2019-5605

FREEBSD-SA-19_14

Produtos afetados

Freebsd

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-5605 · Aviso do Fabricante
• https://security.freebsd.org/advisories/FreeBSD-SA-19:14.freebsd32.asc · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190814-0003 · Nota
• http://packetstormsecurity.com/files/153749/FreeBSD-Security-Advisory-FreeBSD-SA-19-14.freebsd32.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5605 · Nota de Segurança