CVE-2015-1415: Infoleak
The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1415?
CVE-2015-1415 is classified as a high severity vulnerability due to the potential for sensitive information disclosure.
How do I fix CVE-2015-1415?
To mitigate CVE-2015-1415, ensure that the permissions for the /boot/encryption.key file are set to restrict access to only authorized users.
What versions of FreeBSD are affected by CVE-2015-1415?
CVE-2015-1415 affects FreeBSD versions 10.0 and 10.1 prior to patch 9.
What type of data is exposed due to CVE-2015-1415?
CVE-2015-1415 exposes sensitive encryption key information stored in a world-readable keyfile.
Is CVE-2015-1415 a local or remote vulnerability?
CVE-2015-1415 is a local vulnerability, as it requires local access to the system to exploit.