CVE-2019-5596: High severity freebsd kernel vulnerability

Published Feb 12, 2019

Updated

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.

Affected Software

2 affected components

FreeBSD FreeBSD=11.2

FreeBSD FreeBSD=12.0

Remediation

Patch Available

https://security.FreeBSD.org/advisories/FreeBSD-SA-19:02.fd.asc

Event History

Feb 12, 2019

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

DescriptionWeakness

Data Sourced

via NVD·05:29 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-5596?

CVE-2019-5596 has been categorized as having moderate severity due to its potential for privilege escalation.

How do I fix CVE-2019-5596?

You can fix CVE-2019-5596 by upgrading to FreeBSD 12.0-RELEASE-p3 or later, or FreeBSD 11.2-STABLE after r343786.

What does CVE-2019-5596 affect?

CVE-2019-5596 affects FreeBSD versions 11.2 and 12.0 prior to their respective patches.

Can CVE-2019-5596 be exploited remotely?

No, CVE-2019-5596 requires local access to exploit the vulnerability.

What type of vulnerability is CVE-2019-5596?

CVE-2019-5596 is a privilege escalation vulnerability due to a flaw in the reference count implementation for UNIX domain sockets.