What is CVE-2013-5666?

CVE-2013-5666 is a vulnerability in Freebsd, classified under Information Disclosure. Published 2013-09-23.

Is CVE-2013-5666 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Freebsd

CVE-2013-5666

The sendfile system-call implementation in sys/kern/uipc_syscalls.c in the kernel in FreeBSD 9.2-RC1 and 9.2-RC2 does not properly pad transmissions, which allows local users to obtain sensitive information (kernel memory) via a length greater than the length of the file.

Vulnerability class: Information Disclosure

EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.

Affected products

Freebsd — versions 9.2
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

cve@mitre.org (x_refsource_FREEBSD, vendor-advisory, Vendor Advisory)
cve@mitre.org (x_refsource_OSVDB, vdb-entry)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2013-5666?: CVE-2013-5666 is a vulnerability in Freebsd, classified under Information Disclosure. Published 2013-09-23.
Is CVE-2013-5666 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.