PT-2016-1730 · Freebsd · Freebsd

Francisco Falcon + 1 · Published 2016-04-08 · Updated 2018-10-09 · CVE-2016-1885

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.3 before p39 FreeBSD versions 10.1 before p31 FreeBSD versions 10.2 before p14

Description The issue is caused by an integer signedness error in the amd64 set ldt function, located in sys/amd64/amd64/sys machdep.c, which leads to a heap-based buffer overflow. This can be exploited by a local attacker using the i386 set ldt system call, resulting in a denial of service (kernel panic).

Recommendations For FreeBSD version 9.3, update to p39 or later. For FreeBSD version 10.1, update to p31 or later. For FreeBSD version 10.2, update to p14 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-01056

CVE-2016-1885

FREEBSD-SA-16_15

Affected Products

Freebsd

References · 14

• 🔥 https://exploit-db.com/exploits/39570 · Exploit
• 🔥 http://packetstormsecurity.com/files/136276/FreeBSD-Kernel-amd64_set_ldt-Heap-Overflow.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-1885 · Security Note
• https://bdu.fstec.ru/vul/2016-01056 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-16:15.sysarch.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1885 · Vendor Advisory
• http://securitytracker.com/id/1035309 · Note
• http://securityfocus.com/archive/1/archive/1/537812/100/0/threaded · Note
• http://securityfocus.com/archive/1/537813/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2016/Mar/67 · Note
• http://coresecurity.com/advisories/freebsd-kernel-amd64setldt-heap-overflow · Note
• http://securityfocus.com/archive/1/537812/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2016/Mar/56 · Note
• http://securityfocus.com/archive/1/archive/1/537813/100/0/threaded · Note