CVE-2019-5612: Race Condition

Published Aug 29, 2019

Updated

In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.

Affected Software

25 affected components

FreeBSD FreeBSD=11.2

FreeBSD FreeBSD=11.2-p10

FreeBSD FreeBSD=11.2-p11

FreeBSD FreeBSD=11.2-p12

FreeBSD FreeBSD=11.2-p13

FreeBSD FreeBSD=11.2-p2

FreeBSD FreeBSD=11.2-p3

FreeBSD FreeBSD=11.2-p4

FreeBSD FreeBSD=11.2-p5

FreeBSD FreeBSD=11.2-p6

FreeBSD FreeBSD=11.2-p7

FreeBSD FreeBSD=11.2-p8

FreeBSD FreeBSD=11.2-p9

FreeBSD FreeBSD=11.3

FreeBSD FreeBSD=11.3-p1

FreeBSD FreeBSD=11.3-p2

FreeBSD FreeBSD=11.3-p3

FreeBSD FreeBSD=12.0

FreeBSD FreeBSD=12.0-p1

FreeBSD FreeBSD=12.0-p3

FreeBSD FreeBSD=12.0-p4

FreeBSD FreeBSD=12.0-p5

FreeBSD FreeBSD=12.0-p8

NetApp Clustered Data ONTAP

Event History

Aug 29, 2019

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5612?

CVE-2019-5612 has a high severity due to its potential exploitation in multi-threaded environments.

How do I fix CVE-2019-5612?

To fix CVE-2019-5612, upgrade to the patched versions of FreeBSD that include the necessary security updates.

Which FreeBSD versions are affected by CVE-2019-5612?

CVE-2019-5612 affects FreeBSD versions 11.2 before p14, 11.3 before p3, and 12.0 before p10.

What type of vulnerability is CVE-2019-5612?

CVE-2019-5612 is a thread safety issue related to the kernel driver for /dev/midistat.

Can CVE-2019-5612 be exploited remotely?

CVE-2019-5612 requires a local context for exploitation and is not a remote vulnerability.