CVE-2020-25578: Medium severity freebsd kernel vulnerability

Published Mar 26, 2021

Updated

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the doff field of the dirent structures returned by VOPREADDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems.

Affected Software

23 affected components

FreeBSD FreeBSD=11.4

FreeBSD FreeBSD=11.4-p1

FreeBSD FreeBSD=11.4-p2

FreeBSD FreeBSD=11.4-p3

FreeBSD FreeBSD=11.4-p4

FreeBSD FreeBSD=11.4-p5

FreeBSD FreeBSD=11.4-p6

FreeBSD FreeBSD=12.1

FreeBSD FreeBSD=12.1-p1

FreeBSD FreeBSD=12.1-p10

FreeBSD FreeBSD=12.1-p11

FreeBSD FreeBSD=12.1-p12

FreeBSD FreeBSD=12.1-p2

FreeBSD FreeBSD=12.1-p3

FreeBSD FreeBSD=12.1-p4

FreeBSD FreeBSD=12.1-p5

FreeBSD FreeBSD=12.1-p6

FreeBSD FreeBSD=12.1-p7

FreeBSD FreeBSD=12.1-p8

FreeBSD FreeBSD=12.1-p9

FreeBSD FreeBSD=12.2

FreeBSD FreeBSD=12.2-p1

FreeBSD FreeBSD=12.2-p2

Event History

Mar 26, 2021

CVE Published

via MITRE·08:44 PM

Data Sourced

via MITRE·08:44 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-25578?

CVE-2020-25578 is a vulnerability in FreeBSD that affects several file systems and could lead to improper initialization of dirent structures.

How does CVE-2020-25578 impact FreeBSD?

CVE-2020-25578 can impact FreeBSD versions 11.4, 12.1, and 12.2, causing the d_off field of dirent structures to be improperly initialized in certain file systems.

What is the severity of CVE-2020-25578?

CVE-2020-25578 has a severity rating of 5.3, which is considered medium.

How can I fix CVE-2020-25578 in FreeBSD?

To fix CVE-2020-25578, it is recommended to update to the appropriate patched version of FreeBSD, such as 11.4-p7, 12.1-p13, or 12.2-p3, depending on the affected version.

Where can I find more information about CVE-2020-25578?

You can find more information about CVE-2020-25578 in the FreeBSD Security Advisory FreeBSD-SA-21:01.fsdisclosure.asc and the NetApp advisory ntap-20210423-0002.