CVE-2014-3952: Buffer Overflow

Published Jul 15, 2014

Updated

FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.

Affected Software

4 affected components

FreeBSD FreeBSD=8.4

FreeBSD FreeBSD=9.1

FreeBSD FreeBSD=9.2

FreeBSD FreeBSD=10.0

Event History

Jul 15, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3952?

CVE-2014-3952 is classified as a medium severity vulnerability that allows local users to access sensitive kernel memory information.

How do I fix CVE-2014-3952?

To fix CVE-2014-3952, update your FreeBSD to the latest patch version available for your release.

Who is affected by CVE-2014-3952?

CVE-2014-3952 affects FreeBSD versions 8.4 before patch 14, 9.1 before patch 17, 9.2 before patch 10, and 10.0 before patch 7.

What type of vulnerability is CVE-2014-3952?

CVE-2014-3952 is a local information disclosure vulnerability that results from improper initialization of a buffer.

Can CVE-2014-3952 be exploited remotely?

No, CVE-2014-3952 requires local access to the system to exploit the information disclosure.