Memory Corruption Vulnerability in MidnightBSD and FreeBSD Kernels
CVE-2020-24863

5.5MEDIUM

Key Information:

Vendor

Midnightbsd

Status
Midnightbsd
Vendor
CVE Published:
3 September 2020

What is CVE-2020-24863?

A memory corruption issue exists in the kern_getfsstat function for MidnightBSD and FreeBSD kernels. This vulnerability can be exploited by an attacker to induce an invalid free, potentially causing the system to crash. The vulnerability arises from handling crafted size values in connection with invalid modes, enabling malicious actors to disrupt system stability. Users are strongly advised to update their systems to mitigate the risks associated with this vulnerability.

References

https://www.midnightbsd.org/notes/
x_refsource_MISC
https://github.com/MidnightBSD/src/blob/1691c07ff4f27b972...
x_refsource_MISC
http://www.midnightbsd.org/security/adv/MIDNIGHTBSD-SA-20...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.