CVE-2019-15879: Use After Free

Published May 13, 2020

Updated

In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.

Affected Software

14 affected components

FreeBSD FreeBSD=11.3

FreeBSD FreeBSD=11.3-p1

FreeBSD FreeBSD=11.3-p2

FreeBSD FreeBSD=11.3-p3

FreeBSD FreeBSD=11.3-p4

FreeBSD FreeBSD=11.3-p5

FreeBSD FreeBSD=11.3-p6

FreeBSD FreeBSD=11.3-p7

FreeBSD FreeBSD=11.3-p8

FreeBSD FreeBSD=12.1

FreeBSD FreeBSD=12.1-p1

FreeBSD FreeBSD=12.1-p2

FreeBSD FreeBSD=12.1-p3

FreeBSD FreeBSD=12.1-p4

Event History

May 13, 2020

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-15879?

The severity of CVE-2019-15879 is high, with a CVSS score of 7.4.

Which versions of FreeBSD are affected by CVE-2019-15879?

FreeBSD 11.3 and FreeBSD 12.1, along with their corresponding patch versions, are affected by CVE-2019-15879.

What is the vulnerability in CVE-2019-15879?

CVE-2019-15879 is a race condition vulnerability in the cryptodev module of FreeBSD.

How can an unprivileged process exploit CVE-2019-15879?

An unprivileged process can exploit CVE-2019-15879 by causing a data structure in the kernel to be used after it was freed, allowing the process to overwrite arbitrary kernel memory.

Where can I find more information about CVE-2019-15879?

You can find more information about CVE-2019-15879 on the FreeBSD security advisories website and the NetApp security advisory website.