PT-2022-6110 · Freebsd · Freebsd

Lucas Leong + 1 · Published 2022-02-18 · Updated 2024-12-09 · CVE-2022-23086

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The issue is caused by a buffer overflow in the mpr, mps, and mpt drivers, which can lead to heap data overwrite and potentially result in privilege escalation. Users with access to the mpr, mps, or mpt device node, which is only accessible to root and members of the operator group, may exploit this issue. The vulnerability can be triggered by allocating a buffer of a caller-specified size and copying a fixed-size header to it, overwriting other heap content if the specified size is too small.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2023-00050

CVE-2022-23086

FREEBSD-SA-22_06

ZDI-22-1293

ZDI-22-1294

Affected Products

Freebsd

References · 14

• https://bdu.fstec.ru/vul/2023-00050 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1293 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23086 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1294 · Security Note
• https://cgit.freebsd.org/src/commit/?id=8276c4149b5fc7c755d6b244fbbf6dae1939f087 · Note
• https://t.me/cvenotify/71481 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-22:06.ioctl.asc · Note
• https://twitter.com/CVEnew/status/1757997075500085284 · Twitter Post
• https://t.me/cvenotify/77405 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240419-0002 · Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-16723 · Note
• https://t.me/cvenotify/92579 · Telegram Post