PT-2020-9765 · Freebsd · Freebsd

Published 2020-03-19 · Updated 2021-07-21 · CVE-2019-15877

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.1-STABLE before r356606 FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3

Description The issue arises from driver specific ioctl command handlers in the ixl network driver that failed to check whether the caller has sufficient privileges. This allows unprivileged users to trigger updates to the device's non-volatile memory.

Recommendations For FreeBSD versions 12.1-STABLE before r356606, update to a version after r356606 to resolve the issue. For FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3, update to 12.1-RELEASE-p3 or later to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-15877

FREEBSD-SA-20_06

Affected Products

Freebsd

References · 5

• https://security.freebsd.org/advisories/FreeBSD-SA-20:06.if_ixl_ioctl.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15877 · Security Note
• https://t.me/cvenotify/3354 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-20:06.if_ixl_ioctl.asc · Note