Buffer Overwrite Vulnerability in mpr, mps, and mpt Drivers Could Lead to Privilege Escalation

CVE-2022-23086

What is CVE-2022-23086?

The vulnerability arises from improper handling of buffer allocation in the mpr, mps, and mpt drivers within the FreeBSD operating system. These drivers allow users to specify the size of a buffer for read/write operations through ioctl calls. If a user specifies a buffer size smaller than required, the fixed-size header copied into the allocated memory can lead to overwriting other heap data. This flaw can be exploited by users who have access to the device node, which by default is restricted to 'root' and those within the 'operator' group. The risk can lead to privilege escalation, allowing an unauthorized user to gain higher-level access than intended.

References