Description
A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption.
On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FreeBSD | FreeBSD | 13.1-RC1 – < p1, 13.0-RELEASE – < p11, 12.3-RELEASE – < p5 | p1 |