CVE-2017-1088: Infoleak
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the memory of the kldfilestat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible. As a result, some bytes from the kernel stack can be observed in userspace.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1088?
CVE-2017-1088 has a high severity rating due to potential information disclosure vulnerabilities in FreeBSD.
How do I fix CVE-2017-1088?
To fix CVE-2017-1088, you should update to a patched version of FreeBSD that addresses the vulnerability.
Which versions of FreeBSD are affected by CVE-2017-1088?
CVE-2017-1088 affects FreeBSD versions prior to 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24.
What type of vulnerability is CVE-2017-1088?
CVE-2017-1088 is classified as a memory management vulnerability related to clearing sensitive data in the kernel.
Is CVE-2017-1088 exploitable remotely?
CVE-2017-1088 is generally not considered remotely exploitable as it requires local access to the FreeBSD system.