PT-2025-3998 · Freebsd · Freebsd

Yichen Chai + 1 · Published 2025-01-29 · Updated 2025-01-30 · CVE-2025-0662

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description The ktrace facility logs the contents of kernel structures to userspace. In one case, ktrace dumps a variable-sized sockaddr to userspace, copying the full sockaddr even when it is shorter than the full size. This results in up to 14 uninitialized bytes of kernel memory being copied out to userspace. An unprivileged userspace program can leak 14 bytes of a kernel heap allocation to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2025-0662

FREEBSD-SA-25_04

Affected Products

Freebsd

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-0662 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-25:04.ktrace.asc · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1884840775508267217 · Twitter Post
• https://security.netapp.com/advisory/ntap-20250207-0006 · Note
• https://t.me/cvenotify/109118 · Telegram Post
• https://t.me/cvedetector/16742 · Telegram Post
• https://twitter.com/CVEnew/status/1884832697056743533 · Twitter Post
• https://freebsd.org/security/advisories/FreeBSD-SA-25:04.ktrace.asc · Note