Kernel Memory Corruption Vulnerability in nmreq

CVE-2022-23084

What is CVE-2022-23084?

A vulnerability exists in the FreeBSD operating system's netmap feature, where the size of the user-provided nmreq to the nmreq_copyin() function is improperly trusted after being computed. This flaw introduces a time-of-check to time-of-use issue that may result in kernel memory corruption. Particularly vulnerable are systems that have netmap included in their devfs_ruleset, allowing a privileged process operating within a jail to potentially impact the host environment. This poses a significant risk to system integrity and necessitates immediate attention and mitigation.

References