File Conflict Vulnerability in FreeBSD etcupdate Utility

CVE-2025-0374

What is CVE-2025-0374?

The etcupdate utility in FreeBSD has a vulnerability that arises during the process of file merging when conflicts occur. Specifically, when etcupdate encounters merging conflicts, it creates a version of the affected file that contains conflict markers, which is then saved in a public directory. This temporary file, located at /var/db/etcupdate/conflicts, is world-readable and fails to maintain the original file's restricted permissions. As a result, an unprivileged local user may exploit this condition to access sensitive information, such as encrypted root and user passwords, from the temporary master.passwd file. This risk is limited to scenarios where conflicts within the password file occur during updates, and the vulnerability is resolved once the conflicts are cleared and the file is deleted.

References