PT-2020-9764 · Freebsd · Freebsd

Published 2020-03-19 · Updated 2021-07-21 · CVE-2019-15876

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.1-STABLE before r356089 FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3 FreeBSD versions 11.3-STABLE before r356090 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7

Description The issue arises from driver specific ioctl command handlers in the oce network driver, which failed to check whether the caller has sufficient privileges. This allows unprivileged users to send passthrough commands to the device firmware.

Recommendations For FreeBSD versions 12.1-STABLE before r356089, update to a version after r356089. For FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3, update to 12.1-RELEASE-p3 or later. For FreeBSD versions 11.3-STABLE before r356090, update to a version after r356090. For FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7, update to 11.3-RELEASE-p7 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-15876

FREEBSD-SA-20_05

Affected Products

Freebsd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-15876 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15876 · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc · Note
• https://t.me/cvenotify/3353 · Telegram Post