Vulnerability-Lookup

WID-SEC-W-2025-0224

Vulnerability from csaf_certbund - Published: 2025-01-29 23:00 - Updated: 2025-01-29 23:00

Summary

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und gehört damit zu den Unix Derivaten.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen im FreeBSD Project FreeBSD OS ausnutzen, um eine Denial-of-Service-Attacke durchzuführen oder Informationen auszuspähen.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2025-0373

Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Die Schwachstelle ist auf einen Pufferüberlauf zurückzuführen, der in 64-Bit-Systemen, im Modul VOP_VPTOFH() auftritt, wenn bestimmte Dateisysteme (cd9660, tarfs, ext2fs) über NFS exportiert werden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen.

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
FreeBSD Project FreeBSD OS <13.4-STABLE FreeBSD Project / FreeBSD OS		<13.4-STABLE
FreeBSD Project FreeBSD OS <14.2-STABLE FreeBSD Project / FreeBSD OS		<14.2-STABLE

CVE-2025-0374

Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Sie führt dazu, dass beim Zusammenführen von Dateien Konflikte eine Version mit Konfliktmarkierungen in /var/db/etcupdate/conflicts gespeichert wird, die nicht den ursprünglichen, weltweit lesbaren Modus der Datei beibehält. Dies betrifft auch Dateien wie /etc/master.passwd, auf die normalerweise nur eingeschränkt zugegriffen werden kann. Ein lokaler Angreifer kann somit unbefugt Dateien auslesen.

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
FreeBSD Project FreeBSD OS <13.4-STABLE FreeBSD Project / FreeBSD OS		<13.4-STABLE
FreeBSD Project FreeBSD OS <14.2-STABLE FreeBSD Project / FreeBSD OS		<14.2-STABLE

CVE-2025-0662

Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Das ktrace(2)-Modul ermöglicht das Schreiben von bis zu 14 Bytes nicht initialisierten Kernelspeichers in den Userspace. Ein lokaler Angreifer kann dadurch Benutzerinformationen auslesen.

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
FreeBSD Project FreeBSD OS <13.4-STABLE FreeBSD Project / FreeBSD OS		<13.4-STABLE
FreeBSD Project FreeBSD OS <14.2-STABLE FreeBSD Project / FreeBSD OS		<14.2-STABLE

References

5 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://security.FreeBSD.org/advisories/FreeBSD-S…	external
https://security.FreeBSD.org/advisories/FreeBSD-S…	external
https://security.freebsd.org/advisories/FreeBSD-S…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FreeBSD ist ein Open Source Betriebssystem aus der BSD Familie und geh\u00f6rt damit zu den Unix Derivaten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen im FreeBSD Project FreeBSD OS ausnutzen, um eine Denial-of-Service-Attacke durchzuf\u00fchren oder Informationen auszusp\u00e4hen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0224 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0224.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0224 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0224"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory vom 2025-01-29",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-25:02.fs.asc"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory vom 2025-01-29",
        "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-25:03.etcupdate.asc"
      },
      {
        "category": "external",
        "summary": "FreeBSD Security Advisory vom 2025-01-29",
        "url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:04.ktrace.asc"
      }
    ],
    "source_lang": "en-US",
    "title": "FreeBSD Project FreeBSD OS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-01-29T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-30T13:21:51.145+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2025-0224",
      "initial_release_date": "2025-01-29T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-01-29T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c13.4-STABLE",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS \u003c13.4-STABLE",
                  "product_id": "T038681"
                }
              },
              {
                "category": "product_version",
                "name": "13.4-STABLE",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS 13.4-STABLE",
                  "product_id": "T038681-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:freebsd:freebsd:13.4-stable"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.2-STABLE",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS \u003c14.2-STABLE",
                  "product_id": "T040689"
                }
              },
              {
                "category": "product_version",
                "name": "14.2-STABLE",
                "product": {
                  "name": "FreeBSD Project FreeBSD OS 14.2-STABLE",
                  "product_id": "T040689-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:freebsd:freebsd:14.2-stable"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FreeBSD OS"
          }
        ],
        "category": "vendor",
        "name": "FreeBSD Project"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-0373",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Die Schwachstelle ist auf einen Puffer\u00fcberlauf zur\u00fcckzuf\u00fchren, der in 64-Bit-Systemen, im Modul VOP_VPTOFH() auftritt, wenn bestimmte Dateisysteme (cd9660, tarfs, ext2fs) \u00fcber NFS exportiert werden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T038681",
          "T040689"
        ]
      },
      "release_date": "2025-01-29T23:00:00.000+00:00",
      "title": "CVE-2025-0373"
    },
    {
      "cve": "CVE-2025-0374",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Sie f\u00fchrt dazu, dass beim Zusammenf\u00fchren von Dateien Konflikte eine Version mit Konfliktmarkierungen in /var/db/etcupdate/conflicts gespeichert wird, die nicht den urspr\u00fcnglichen, weltweit lesbaren Modus der Datei beibeh\u00e4lt. Dies betrifft auch Dateien wie /etc/master.passwd, auf die normalerweise nur eingeschr\u00e4nkt zugegriffen werden kann. Ein lokaler Angreifer kann somit unbefugt Dateien auslesen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T038681",
          "T040689"
        ]
      },
      "release_date": "2025-01-29T23:00:00.000+00:00",
      "title": "CVE-2025-0374"
    },
    {
      "cve": "CVE-2025-0662",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in FreeBSD Project FreeBSD OS. Das ktrace(2)-Modul erm\u00f6glicht das Schreiben von bis zu 14 Bytes nicht initialisierten Kernelspeichers in den Userspace. Ein lokaler Angreifer kann dadurch Benutzerinformationen auslesen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T038681",
          "T040689"
        ]
      },
      "release_date": "2025-01-29T23:00:00.000+00:00",
      "title": "CVE-2025-0662"
    }
  ]
}

CVE-2025-0373 (GCVE-0-2025-0373)

Vulnerability from cvelistv5 – Published: 2025-01-30 04:48 – Updated: 2025-02-07 17:02

Title

Buffer overflow in some filesystems via NFS

Summary

On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow. A NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic by mounting and accessing the export with an NFS client. Further exploitation (e.g., bypassing file permission checking or remote kernel code execution) is potentially possible, though this has not been demonstrated. In particular, release kernels are compiled with stack protection enabled, and some instances of the overflow are caught by this mechanism, causing a panic.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

CWE

CWE-121 - Stack-based Overflow

Assigner

freebsd

References

1 reference

URL	Tags
https://security.freebsd.org/advisories/FreeBSD-S…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
FreeBSD	FreeBSD	Affected: 14.2-RELEASE , < p1 (release) Affected: 14.1-RELEASE , < p7 (release) Affected: 13.4-RELEASE , < p3 (release)

Date Public

2025-01-29 21:31

Credits

Kevin Miller

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-0373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T15:53:35.828001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:55:39.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-07T17:02:45.863Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250207-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "fs"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.2-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p7",
              "status": "affected",
              "version": "14.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p3",
              "status": "affected",
              "version": "13.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kevin Miller"
        }
      ],
      "datePublic": "2025-01-29T21:31:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow.\n\nA NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic by mounting and accessing the export with an NFS client.  Further exploitation (e.g., bypassing file permission checking or remote kernel code execution) is potentially possible, though this has not been demonstrated.  In particular, release kernels are compiled with stack protection enabled, and some instances of the overflow are caught by this mechanism, causing a panic."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T04:48:03.054Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:02.fs.asc"
        }
      ],
      "title": "Buffer overflow in some filesystems via NFS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2025-0373",
    "datePublished": "2025-01-30T04:48:03.054Z",
    "dateReserved": "2025-01-10T08:47:56.804Z",
    "dateUpdated": "2025-02-07T17:02:45.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-0374 (GCVE-0-2025-0374)

Vulnerability from cvelistv5 – Published: 2025-01-30 04:49 – Updated: 2025-02-07 17:02

Title

Unprivileged access to system files

Summary

When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally have restricted visibility, such as /etc/master.passwd. An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

freebsd

References

1 reference

URL	Tags
https://security.freebsd.org/advisories/FreeBSD-S…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
FreeBSD	FreeBSD	Affected: 14.2-RELEASE , < p1 (release) Affected: 14.1-RELEASE , < p7 (release) Affected: 13.4-RELEASE , < p3 (release)

Date Public

2025-01-29 21:45

Credits

Christos Chatzaras

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-0374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T15:41:16.838358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T15:43:07.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-07T17:02:52.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250207-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "etcupdate"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.2-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p7",
              "status": "affected",
              "version": "14.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p3",
              "status": "affected",
              "version": "13.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christos Chatzaras"
        }
      ],
      "datePublic": "2025-01-29T21:45:18.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts.  This version does not preserve the mode of the input file, and is world-readable.  This applies to files that would normally have restricted visibility, such as /etc/master.passwd.\n\nAn unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts.  This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T04:49:07.687Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc"
        }
      ],
      "title": "Unprivileged access to system files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2025-0374",
    "datePublished": "2025-01-30T04:49:07.687Z",
    "dateReserved": "2025-01-10T08:54:23.906Z",
    "dateUpdated": "2025-02-07T17:02:52.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-0662 (GCVE-0-2025-0662)

Vulnerability from cvelistv5 – Published: 2025-01-30 04:49 – Updated: 2025-02-07 17:02

Title

Uninitialized kernel memory disclosure via ktrace(2)

Summary

In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to userspace. There, the full sockaddr is copied, even when it is shorter than the full size. This can result in up to 14 uninitialized bytes of kernel memory being copied out to userspace. It is possible for an unprivileged userspace program to leak 14 bytes of a kernel heap allocation to userspace.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

freebsd

References

1 reference

URL	Tags
https://security.freebsd.org/advisories/FreeBSD-S…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
FreeBSD	FreeBSD	Affected: 14.2-RELEASE , < p1 (release)

Date Public

2025-01-29 21:33

Credits

Yichen Chai Zhuo Ying Jiang Li

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-0662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T15:20:56.339386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-31T20:00:09.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-07T17:02:55.076Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250207-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ktrace"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "14.2-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yichen Chai"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhuo Ying Jiang Li"
        }
      ],
      "datePublic": "2025-01-29T21:33:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In some cases, the ktrace facility will log the contents of kernel structures to userspace.  In one such case, ktrace dumps a variable-sized sockaddr to userspace.  There, the full sockaddr is copied, even when it is shorter than the full size.  This can result in up to 14 uninitialized bytes of kernel memory being copied out to userspace.\n\nIt is possible for an unprivileged userspace program to leak 14 bytes of a kernel heap allocation to userspace."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T04:49:56.482Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:04.ktrace.asc"
        }
      ],
      "title": "Uninitialized kernel memory disclosure via ktrace(2)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2025-0662",
    "datePublished": "2025-01-30T04:49:56.482Z",
    "dateReserved": "2025-01-23T01:56:01.677Z",
    "dateUpdated": "2025-02-07T17:02:55.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-0224

CVE-2025-0373 (GCVE-0-2025-0373)

CVE-2025-0374 (GCVE-0-2025-0374)

CVE-2025-0662 (GCVE-0-2025-0662)

Tags

Sightings

Nomenclature