PT-2016-2096 · Freebsd · Freebsd

Cturt · Published 2016-05-17 · Updated 2017-04-20 · CVE-2016-1886

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.3 before p42 FreeBSD versions 10.1 before p34 FreeBSD versions 10.2 before p17 FreeBSD versions 10.3 before p3

Description The issue is caused by an integer signedness error in the genkbd commonioctl function, located in sys/dev/kbd/kbd.c, which can lead to a buffer overflow. This allows a local attacker to obtain sensitive information from kernel memory, cause a denial of service, or gain privileges. The vulnerability is triggered by a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call.

Recommendations For FreeBSD version 9.3, update to p42 or later. For FreeBSD version 10.1, update to p34 or later. For FreeBSD version 10.2, update to p17 or later. For FreeBSD version 10.3, update to p3 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-01448

CVE-2016-1886

FREEBSD-SA-16_18

Affected Products

Freebsd

References · 9

• 🔥 http://cturt.github.io/SETFKEY.html · Exploit
• 🔥 https://exploit-db.com/exploits/44211 · Exploit
• https://security.freebsd.org/patches/SA-16:18/atkbd.patch · Patch
• https://freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1886 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1886 · Vendor Advisory
• http://securityfocus.com/bid/90734 · Note
• http://securitytracker.com/id/1035905 · Note