PT-2023-32071 · Msdosfs+1 · Msdosfs+1

Maxim Suhanov · Published 2023-10-03 · Updated 2023-11-29 · CVE-2023-5368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions msdosfs (affected versions not specified)

Description The issue arises when the 'truncate' or 'ftruncate' system calls are used on an msdosfs filesystem under certain circumstances. Instead of populating the additional space in the file with zero bytes, these calls fill the space with unallocated data from the underlying disk device. This may allow a user with write access to files on the msdosfs filesystem to read unintended data, such as from a previously deleted file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2023-5368

FREEBSD-SA-23_12

Affected Products

Freebsd

Msdosfs

References · 8

• https://osv.dev/vulnerability/CVE-2023-5368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5368 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-23:12.msdosfs.asc · Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20231124-0004 · Note
• https://twitter.com/VulmonFeeds/status/1709442460307407056 · Twitter Post
• https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case · Note
• https://twitter.com/CVEnew/status/1709416461809463427 · Twitter Post
• https://t.me/cvenotify/61081 · Telegram Post