Description
In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FreeBSD | FreeBSD 12.2-RELEASE before p3, 12.1-RELEASE before p13, 11.4-RELEASE before p7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
farazsth98/freebsd-dirent-info-leak-bugs ★ 7 · Dec 5, 2020
CVE-2020-25578 and CVE-2020-25579: Some FreeBSD info leak bugs I found in 2020.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.