Linux Kernel Vulnerability: Proc_getargv() May Return Zero-Length String, Leading to Out-of-Bound Read

CVE-2022-23089

What is CVE-2022-23089?

The vulnerability occurs in FreeBSD's handling of process information during a core dump. Specifically, the function proc_getargv() can return a buffer with an incorrect length, which may either be zero or negative. This issue can be exploited by a user constructing a specially crafted ps_string, leading to an out-of-bound read condition that can subsequently cause the kernel to crash. As a result, systems running affected versions of FreeBSD are at risk of instability and potential denial-of-service conditions if not properly patched.

References