PT-2024-11519 · Freebsd · Freebsd

Jeff + 1 · Published 2022-08-09 · Updated 2025-06-04 · CVE-2022-23089

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue arises when dumping core and saving process information, as proc getargv() might return an sbuf with an sbuf len() of 0 or -1, which is not properly handled. This can lead to an out-of-bound read when a user constructs a specially crafted ps string, potentially causing the kernel to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-23089

FREEBSD-SA-22_09

Affected Products

Freebsd

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-23089 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23089 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-22:09.elf.asc · Note
• https://twitter.com/CVEnew/status/1758000524010340566 · Twitter Post
• https://t.me/cvenotify/124675 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240415-0006 · Note