CVE-2019-5601: Infoleak

Published Jul 3, 2019

Updated

In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the FFS implementation causes up to three bytes of kernel stack memory to be written to disk as uninitialized directory entry padding.

Affected Software

17 affected components

FreeBSD FreeBSD=11.2

FreeBSD FreeBSD=11.2-p10

FreeBSD FreeBSD=11.2-p2

FreeBSD FreeBSD=11.2-p3

FreeBSD FreeBSD=11.2-p4

FreeBSD FreeBSD=11.2-p5

FreeBSD FreeBSD=11.2-p6

FreeBSD FreeBSD=11.2-p7

FreeBSD FreeBSD=11.2-p9

FreeBSD FreeBSD=11.2-rc3

FreeBSD FreeBSD=12.0

FreeBSD FreeBSD=12.0-p1

FreeBSD FreeBSD=12.0-p2

FreeBSD FreeBSD=12.0-p3

FreeBSD FreeBSD=12.0-p4

FreeBSD FreeBSD=12.0-p5

FreeBSD FreeBSD=12.0-p6

Event History

Jul 3, 2019

CVE Published

via MITRE·06:51 PM

Data Sourced

via MITRE·06:51 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5601?

CVE-2019-5601 has been classified as a medium severity vulnerability due to its potential to expose uninitialized kernel stack memory.

What versions of FreeBSD are affected by CVE-2019-5601?

CVE-2019-5601 affects FreeBSD versions 11.2 before p11 and 12.0 before p7.

How do I fix CVE-2019-5601?

To fix CVE-2019-5601, upgrade your FreeBSD installation to the latest patched versions, specifically 11.2-RELEASE-p11 or 12.0-RELEASE-p7.

What type of vulnerability is CVE-2019-5601?

CVE-2019-5601 is a vulnerability in the FFS implementation that allows uninitialized directory entry padding to be written to disk.

Is CVE-2019-5601 a remote exploit?

CVE-2019-5601 does not represent a remote exploit, but it can potentially allow local attackers to read sensitive information.