Information disclosure in FreeBSD - CVE-2019-5601

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU35767

Information disclosure in FreeBSD - CVE-2019-5601

Published: July 3, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU35767
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5601
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to gain access to sensitive information.

In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the FFS implementation causes up to three bytes of kernel stack memory to be written to disk as uninitialized directory entry padding.


Affected software

FreeBSD
EMC Isilon OneFS

How to mitigate CVE-2019-5601

Install update from vendor's website.

EMC Isilon OneFS - update to 8.2.1

External References

Related Security Bulletins