PT-2013-5744 · Freebsd · Freebsd

Published 2013-09-23 · Updated 2013-10-24 · CVE-2013-5710

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 9.2

Description The issue concerns the nullfs implementation in the kernel, specifically in sys/fs/nullfs/null vnops.c. It allows local users with certain permissions to bypass access restrictions. This is achieved by creating a hardlink in a nullfs instance to a file in a different instance.

Recommendations For FreeBSD versions 8.3 through 9.2, consider restricting access to nullfs instances to minimize the risk of exploitation. As a temporary workaround, limit the ability of local users to create hardlinks between different nullfs instances until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5710

DSA-2769-1

Affected Products

Freebsd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-5710 · Security Note
• http://debian.org/security/2013/dsa-2769 · Vendor Advisory
• http://freebsd.org/security/advisories/FreeBSD-SA-13:13.nullfs.asc · Vendor Advisory
• http://securitytracker.com/id/1029015 · Note
• http://secunia.com/advisories/54861 · Note
• http://svnweb.freebsd.org/base?view=revision&revision=255442 · Note