by Kastro
Paper/Archive/CVE-2022-23085

CVE-2022-23085

FreeBSD FreeBSD — Potential jail escape vulnerabilities in netmap

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.2.422 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.

Affected

ProductAffectedFixed inSource
FreeBSD13.1-RC1 – < p1p1CNA
FreeBSD13.0-RELEASE – < p11p11CNA
FreeBSD12.3-RELEASE – < p5p5CNA
freebsd13.0 – < 13.0_p1113.0_p11CISA-ADP
freebsd12.3 – < 12.3_p512.3_p5CISA-ADP
freebsd13.1 – < 13.1-rc-p13.1-rc-pCISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.ascrefsecurity.netapp.com/advisory/ntap-20240322-0004