diff options
| author | Philip Paeps <philip@FreeBSD.org> | 2022-04-07 03:05:55 +0000 |
|---|---|---|
| committer | Philip Paeps <philip@FreeBSD.org> | 2022-04-07 03:05:55 +0000 |
| commit | 4fffe7a378cb0892302b9bac2783fd7c1ea33401 (patch) | |
| tree | 55d87ffc310e44a8137ca2f05a51577021ad9a37 /security | |
| parent | c6a2657ffc77febe8a417969bd9dd856ea652f40 (diff) | |
| download | ports-4fffe7a378cb0892302b9bac2783fd7c1ea33401.tar.gz ports-4fffe7a378cb0892302b9bac2783fd7c1ea33401.zip | |
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln-2022.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 27be7751c5d7..7508ad2d1ca9 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,36 @@ + <vuln vid="703c4761-b61d-11ec-9ebc-1c697aa5a594"> + <topic>FreeBSD -- mpr/mps/mpt driver ioctl heap out-of-bounds write</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>13.0</ge><lt>13.0_11</lt></range> + <range><ge>12.3</ge><lt>12.3_5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <h1>Problem Description:</h1> + <p>Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and + mpt drivers allocated a buffer of a caller-specified size, but + copied to it a fixed size header. Other heap content would be + overwritten if the specified size was too small.</p> + <h1>Impact:</h1> + <p>Users with access to the mpr, mps or mpt device node may overwrite + heap data, potentially resulting in privilege escalation. Note that + the device node is only accessible to root and members of the operator + group.</p> + </body> + </description> + <references> + <cvename>CVE-2022-23086</cvename> + <freebsdsa>SA-22:06.ioctl</freebsdsa> + </references> + <dates> + <discovery>2022-04-06</discovery> + <entry>2022-04-07</entry> + </dates> + </vuln> + <vuln vid="ba796b98-b61c-11ec-9ebc-1c697aa5a594"> <topic>FreeBSD -- Bhyve e82545 device emulation out-of-bounds write</topic> <affects> |