CVE-2014-3953: Buffer Overflow

Published Jul 15, 2014

Updated

FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTPSNDRCV, (2) SCTPEXTRCV, or (3) SCTPRCVINFO SCTP cmsg or a (4) SCTPPEERADDRCHANGE, (5) SCTPREMOTEERROR, or (6) SCTPAUTHENTICATIONEVENT notification.

Affected Software

4 affected components

FreeBSD FreeBSD=8.4

FreeBSD FreeBSD=9.1

FreeBSD FreeBSD=9.2

FreeBSD FreeBSD=10.0

Event History

Jul 15, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3953?

CVE-2014-3953 is categorized as a medium severity vulnerability due to its potential for local users to access sensitive kernel memory.

How do I fix CVE-2014-3953?

To mitigate CVE-2014-3953, it is recommended to update FreeBSD to the latest versions that have addressed this vulnerability.

Who is affected by CVE-2014-3953?

CVE-2014-3953 affects FreeBSD versions 8.4 before patch p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7.

What type of systems are vulnerable to CVE-2014-3953?

Local users on FreeBSD systems running vulnerable versions may exploit CVE-2014-3953 to access restricted kernel memory.

What are the attack vectors for CVE-2014-3953?

The attack vectors for CVE-2014-3953 include local exploitation through SCTP cmsg types such as SCTP_SNDRCV and SCTP_RCVINFO.