PT-2018-2739 · Freebsd · Freebsd

Mark Johnston + 1 · Published 2018-09-12 · Updated 2019-04-10 · CVE-2018-6924

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 11.1-STABLE FreeBSD versions prior to 11.2-RELEASE-p3 FreeBSD versions prior to 11.1-RELEASE-p14 FreeBSD versions prior to 10.4-STABLE FreeBSD versions prior to 10.4-RELEASE-p12

Description The issue is caused by insufficient validation in the ELF header parser, which could allow a malicious ELF binary to cause a kernel crash or disclose kernel memory. This could potentially impact the confidentiality of protected information or cause a denial of service.

Recommendations For versions prior to 11.1-STABLE, update to 11.1-STABLE or later. For versions prior to 11.2-RELEASE-p3, update to 11.2-RELEASE-p3 or later. For versions prior to 11.1-RELEASE-p14, update to 11.1-RELEASE-p14 or later. For versions prior to 10.4-STABLE, update to 10.4-STABLE or later. For versions prior to 10.4-RELEASE-p12, update to 10.4-RELEASE-p12 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01667

CVE-2018-6924

FREEBSD-SA-18_12

Affected Products

Freebsd

References · 8

• https://bdu.fstec.ru/vul/2019-01667 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-6924 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6924 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-18:12.elf.asc · Vendor Advisory
• http://securitytracker.com/id/1041646 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10937&cat=SIRT_1&actp=LIST&showDraft=false · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10937&cat=SIRT_1&actp=LIST&showDraft=false · Note
• https://freebsd.org/security/advisories/FreeBSD-SA-18:12.elf.asc · Note