CVE-2019-5602: Critical severity freebsd kernel vulnerability

Published Jul 3, 2019
·
Updated

In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the cdrom driver allows users with read access to the cdrom device to arbitrarily overwrite kernel memory when media is present thereby allowing a malicious user in the operator group to gain root privileges.

Affected Software

18 affected components
FreeBSD FreeBSD=11.2
FreeBSD FreeBSD=11.2-p10
FreeBSD FreeBSD=11.2-p2
FreeBSD FreeBSD=11.2-p3
FreeBSD FreeBSD=11.2-p4
FreeBSD FreeBSD=11.2-p5
FreeBSD FreeBSD=11.2-p6
FreeBSD FreeBSD=11.2-p7
FreeBSD FreeBSD=11.2-p9
FreeBSD FreeBSD=11.2-rc3
FreeBSD FreeBSD=11.3-rc3
FreeBSD FreeBSD=12.0
FreeBSD FreeBSD=12.0-p1
FreeBSD FreeBSD=12.0-p2
FreeBSD FreeBSD=12.0-p3
FreeBSD FreeBSD=12.0-p4
FreeBSD FreeBSD=12.0-p5
FreeBSD FreeBSD=12.0-p6

Event History

Jul 3, 2019
CVE Published
via MITRE·06:52 PM
Data Sourced
via MITRE·06:52 PM
DescriptionWeakness

Frequently Asked Questions

1

What is the severity of CVE-2019-5602?

CVE-2019-5602 is considered a high severity vulnerability due to the potential for arbitrary kernel memory overwriting.

2

How do I fix CVE-2019-5602?

To fix CVE-2019-5602, upgrade to FreeBSD versions 12.0-RELEASE-p7 or later, or 11.2-RELEASE-p11 or later.

3

What systems are affected by CVE-2019-5602?

CVE-2019-5602 affects FreeBSD versions 11.2 through 12.0 prior to specific patch versions.

4

Can I exploit CVE-2019-5602 with read access to the CD-ROM device?

Yes, exploitation of CVE-2019-5602 requires a user to have read access to the CD-ROM device.

5

Is there any known workaround for CVE-2019-5602?

There are no known workarounds for CVE-2019-5602; the best mitigation is to apply the relevant patches.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203