CVE-2022-23085 Potential jail escape vulnerabilities in netmap

2024-02-1504:52:17

freebsd

www.cve.org

jail escape

netmap

integer overflow

bounds checking

kernel memory corruption

devfs_ruleset

6.5 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

16.2%

JSON

A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "netmap"
    ],
    "product": "FreeBSD",
    "vendor": "FreeBSD",
    "versions": [
      {
        "lessThan": "p1",
        "status": "affected",
        "version": "13.1-RC1",
        "versionType": "release"
      },
      {
        "lessThan": "p11",
        "status": "affected",
        "version": "13.0-RELEASE",
        "versionType": "release"
      },
      {
        "lessThan": "p5",
        "status": "affected",
        "version": "12.3-RELEASE",
        "versionType": "release"
      }
    ]
  }
]