PT-2023-32071 · Msdosfs+1 · Msdosfs+1

Maxim Suhanov · Publicado 2023-10-03 · Atualizado 2023-11-29 · CVE-2023-5368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions msdosfs (affected versions not specified)

Description The issue arises when the 'truncate' or 'ftruncate' system calls are used on an msdosfs filesystem under certain circumstances. Instead of populating the additional space in the file with zero bytes, these calls fill the space with unallocated data from the underlying disk device. This may allow a user with write access to files on the msdosfs filesystem to read unintended data, such as from a previously deleted file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2023-5368

FREEBSD-SA-23_12

Produtos afetados

Freebsd

Msdosfs

Referências · 8

• https://security.freebsd.org/advisories/FreeBSD-SA-23:12.msdosfs.asc · Correção, Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20231124-0004 · Nota
• https://twitter.com/VulmonFeeds/status/1709442460307407056 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5368 · Aviso do Fabricante
• https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case · Nota
• https://twitter.com/CVEnew/status/1709416461809463427 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5368 · Nota de Segurança
• https://t.me/cvenotify/61081 · Publicação no Telegram