PT-2020-19589
CVE-2020-7453
·
تاريخ النشر
2020-03-19
·
تاريخ التحديث
2020-05-06
الوصف من
CVSS 3.1
6.0
متوسطةالمقاييسAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
FreeBSD versions 12.1-STABLE before r359021
FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3
FreeBSD versions 11.3-STABLE before r359020
FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7
Description
A missing null termination check in the
osrelease configuration option of the jail set function may return more bytes with a subsequent jail get system call, allowing a malicious jail superuser with permission to create nested jails to read kernel memory.Recommendations
For FreeBSD versions 12.1-STABLE before r359021, update to a version after r359021 to resolve the issue.
For FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3, update to 12.1-RELEASE-p3 or later to resolve the issue.
For FreeBSD versions 11.3-STABLE before r359020, update to a version after r359020 to resolve the issue.
For FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7, update to 11.3-RELEASE-p7 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾