Buffer overflow in Freebsd
CVE-2022-23086
Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (36.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Freebsd — versions 13.1-RC1, 12.3-RELEASE, 13.0-RELEASE
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secteam@freebsd.org (vendor-advisory, Vendor Advisory)
- secteam@freebsd.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-23086?
- CVE-2022-23086 is a high-severity vulnerability in Freebsd, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2024-02-15.
- How severe is CVE-2022-23086?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2022-23086 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.