PT-2019-4135 · Freebsd · Freebsd

Karsten Kã¶Nig · Published 2019-07-23 · Updated 2023-03-29 · CVE-2019-5603

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 12.0-RELEASE-p8 FreeBSD versions prior to 11.3-RELEASE-p1 FreeBSD versions prior to 11.2-RELEASE-p12

Description The issue is related to the mqueuefs module in FreeBSD, which has inadequate access control. This allows a malicious user to potentially gain unauthorized access to files, directories, and sockets opened by other users' processes.

Recommendations For versions prior to 12.0-RELEASE-p8, update to 12.0-RELEASE-p8 or later. For versions prior to 11.3-RELEASE-p1, update to 11.3-RELEASE-p1 or later. For versions prior to 11.2-RELEASE-p12, update to 11.2-RELEASE-p12 or later.

Fix

Improper Resource Release

Weakness Enumeration

CWE-264

CWE-404

Related Identifiers

BDU:2019-04715

CVE-2019-5603

FREEBSD-SA-19_15

FREEBSD-SA-19_24

Affected Products

Freebsd

References · 10

• https://security.freebsd.org/advisories/FreeBSD-SA-19:15.mqueuefs.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5603 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04715 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-19:24.mqueuefs.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5603 · Security Note
• https://security.netapp.com/advisory/ntap-20190814-0003 · Note
• https://seclists.org/bugtraq/2019/Aug/35 · Note
• https://t.me/defcon_news/111536 · Telegram Post
• http://packetstormsecurity.com/files/154172/FreeBSD-Security-Advisory-FreeBSD-SA-19-24.mqueuefs.html · Note
• http://packetstormsecurity.com/files/153752/FreeBSD-Security-Advisory-FreeBSD-SA-19-15.mqueuefs.html · Note