PT-2023-7883 · Freebsd · Freebsd

Hostpoint Ag · Published 2023-12-12 · Updated 2024-03-22 · CVE-2023-6660

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The issue is related to a bug in the NFS client of FreeBSD operating systems, which can cause the NFS client to fail to copy data to be written but proceed as though the copy operation had succeeded. This can lead to the disclosure of sensitive information. The leak is limited to data previously stored in mbufs, which are used for network transmission and reception, and for certain types of inter-process communication. The bug can be triggered unintentionally by system applications, resulting in corrupted data being written over the network to the NFS server, making it susceptible to being snooped by other hosts on the network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-08954

CVE-2023-6660

FREEBSD-SA-23_18

Affected Products

Freebsd

References · 12

• https://bdu.fstec.ru/vul/2023-08954 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6660 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-23:18.nfsclient.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6660 · Security Note
• https://vuldb.com/?id.247870 · Note
• https://t.me/cvenotify/63424 · Telegram Post
• https://t.me/cvenotify/74472 · Telegram Post
• https://twitter.com/RedPacketSec/status/1737051463845605419 · Twitter Post
• https://twitter.com/CVEnew/status/1734855470899150965 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734900341110390804 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240322-0002 · Note
• https://freebsd.org/security/advisories/FreeBSD-SA-23:18.nfsclient.asc · Note