CVE-2018-17155: Infoleak
In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts privileged kernel data.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17155?
The severity of CVE-2018-17155 is classified as medium due to potential information disclosure.
How do I fix CVE-2018-17155?
To fix CVE-2018-17155, update FreeBSD to a version that is 11.2-STABLE(r338983) or later, 11.2-RELEASE-p5 or later, 11.1-RELEASE-p16 or later, or 10.4-RELEASE-p14 or later.
Which versions of FreeBSD are affected by CVE-2018-17155?
CVE-2018-17155 affects FreeBSD versions prior to 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, and 10.4-RELEASE-p13.
What does CVE-2018-17155 exploit?
CVE-2018-17155 exploits insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls.
Is CVE-2018-17155 easily exploitable?
Exploitation of CVE-2018-17155 requires local access to the affected system, making it less likely to be exploited remotely.