Kernel Memory Corruption Vulnerability in nmreq
CVE-2022-23084

7.5HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
15 February 2024

What is CVE-2022-23084?

A vulnerability exists in the FreeBSD operating system's netmap feature, where the size of the user-provided nmreq to the nmreq_copyin() function is improperly trusted after being computed. This flaw introduces a time-of-check to time-of-use issue that may result in kernel memory corruption. Particularly vulnerable are systems that have netmap included in their devfs_ruleset, allowing a privileged process operating within a jail to potentially impact the host environment. This poses a significant risk to system integrity and necessitates immediate attention and mitigation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FreeBSD 13.1-RC1

FreeBSD 13.0-RELEASE

FreeBSD 12.3-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-22:04....
vendor-advisory
https://security.netapp.com/advisory/ntap-20240419-0003/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reno Robert
Lucas Leong (@_wmliang_)
Trend Micro Zero Day Initiative
JSON
.