CVE-2020-25579: Medium severity freebsd kernel vulnerability

Published Mar 26, 2021

Updated

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

Affected Software

23 affected components

FreeBSD FreeBSD=11.4

FreeBSD FreeBSD=11.4-p1

FreeBSD FreeBSD=11.4-p2

FreeBSD FreeBSD=11.4-p3

FreeBSD FreeBSD=11.4-p4

FreeBSD FreeBSD=11.4-p5

FreeBSD FreeBSD=11.4-p6

FreeBSD FreeBSD=12.1

FreeBSD FreeBSD=12.1-p1

FreeBSD FreeBSD=12.1-p10

FreeBSD FreeBSD=12.1-p11

FreeBSD FreeBSD=12.1-p12

FreeBSD FreeBSD=12.1-p2

FreeBSD FreeBSD=12.1-p3

FreeBSD FreeBSD=12.1-p4

FreeBSD FreeBSD=12.1-p5

FreeBSD FreeBSD=12.1-p6

FreeBSD FreeBSD=12.1-p7

FreeBSD FreeBSD=12.1-p8

FreeBSD FreeBSD=12.1-p9

FreeBSD FreeBSD=12.2

FreeBSD FreeBSD=12.2-p1

FreeBSD FreeBSD=12.2-p2

Event History

Mar 26, 2021

CVE Published

via MITRE·08:44 PM

Data Sourced

via MITRE·08:44 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-25579?

CVE-2020-25579 is a vulnerability in FreeBSD that allows for a leak of uninitialized bytes due to a failure to zero-fill padding fields in the dirent structure.

How does CVE-2020-25579 affect FreeBSD?

CVE-2020-25579 affects FreeBSD versions 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13, and 11.4-RELEASE before p7.

What is the severity of CVE-2020-25579?

The severity of CVE-2020-25579 is medium with a CVSS score of 5.3.

How do I fix CVE-2020-25579?

To fix CVE-2020-25579, users should update their FreeBSD installations to the appropriate patched versions.

Where can I find more information about CVE-2020-25579?

More information about CVE-2020-25579 can be found in the FreeBSD Security Advisory and the NetApp Security Advisory.