Lucene search

FreebsdCVE-2018-17155

HistorySep 28, 2018 - 1:29 p.m.

CVE-2018-17155

2018-09-2813:29:00

CWE-200

freebsd

web.nvd.nist.gov

cve-2018-17155

freebsd

memory disclosure

vulnerability

security漏洞

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

5.1%

JSON

In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts privileged kernel data.

Affected configurations

Nvd

Node

freebsdfreebsdRange<11.2

freebsdfreebsdMatch10.4

freebsdfreebsdMatch10.4p13

freebsdfreebsdMatch11.1p15

freebsdfreebsdMatch11.2p4

VendorProductVersionCPE
freebsdfreebsd*cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
freebsdfreebsd10.4cpe:2.3:o:freebsd:freebsd:10.4:*:*:*:*:*:*:*
freebsdfreebsd10.4cpe:2.3:o:freebsd:freebsd:10.4:p13:*:*:*:*:*:*
freebsdfreebsd11.1cpe:2.3:o:freebsd:freebsd:11.1:p15:*:*:*:*:*:*
freebsdfreebsd11.2cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:*

Vendor	Product	Version	CPE
freebsd	freebsd	*	cpe:2.3:o:freebsd:freebsd::::::::
freebsd	freebsd	10.4	cpe:2.3:o:freebsd:freebsd:10.4:::::::*
freebsd	freebsd	10.4	cpe:2.3:o:freebsd:freebsd:10.4:p13::::::
freebsd	freebsd	11.1	cpe:2.3:o:freebsd:freebsd:11.1:p15::::::
freebsd	freebsd	11.2	cpe:2.3:o:freebsd:freebsd:11.2:p4::::::

CNA Affected

[
  {
    "product": "FreeBSD",
    "vendor": "FreeBSD",
    "versions": [
      {
        "status": "affected",
        "version": "11.2 before 11.2-RELEASE-p4"
      },
      {
        "status": "affected",
        "version": "11.1 before 11.1-RELEASE-p15"
      },
      {
        "status": "affected",
        "version": "10.x before 10.4-RELEASE-p13"
      }
    ]
  }
]

References

security.FreeBSD.org/advisories/FreeBSD-EN-18:12.mem.asc

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2018-17155