CVE-2022-23086

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2022-23086

CVE-2022-23086 affects FreeBSD: the mpr/mps/mpt disk controller drivers expose _CFG_PAGE ioctls that allocate a caller-specified buffer size but copy a fixed-size header into it. This can result in heap data being overwritten if the input size is too small, potentially enabling privilege escalati...

CVE-2022-23086 mpr/mps/mpt driver ioctl heap out-of-bounds write

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2022-23086 mpr/mps/mpt driver ioctl heap out-of-bounds write

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

FreeBSD : FreeBSD -- mpr/mps/mpt driver ioctl heap out-of-bounds write (703c4761-b61d-11ec-9ebc-1c697aa5a594)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 703c4761-b61d-11ec-9ebc-1c697aa5a594 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

FreeBSD-SA-22:06.ioctl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-22:06.ioctl Security Advisory The FreeBSD Project Topic: mpr/mps/mpt driver ioctl heap out-of-bounds write Category: core Module: mpr, mps, mpt Announced:...