CVE-2022-23086: mpr/mps/mpt driver ioctl heap out-of-bounds write
First published: Thu Feb 15 2024(Updated: )
Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.
Credit: secteam@freebsd.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreeBSD FreeBSD | >=12.0<12.3 | |
| FreeBSD FreeBSD | =12.3 | |
| FreeBSD FreeBSD | =12.3-p1 | |
| FreeBSD FreeBSD | =12.3-p2 | |
| FreeBSD FreeBSD | =12.3-p3 | |
| FreeBSD FreeBSD | =12.3-p4 | |
| FreeBSD FreeBSD | =13.0 | |
| FreeBSD FreeBSD | =13.0-beta1 | |
| FreeBSD FreeBSD | =13.0-beta2 | |
| FreeBSD FreeBSD | =13.0-beta3 | |
| FreeBSD FreeBSD | =13.0-beta3-p1 | |
| FreeBSD FreeBSD | =13.0-beta4 | |
| FreeBSD FreeBSD | =13.0-p1 | |
| FreeBSD FreeBSD | =13.0-p10 | |
| FreeBSD FreeBSD | =13.0-p2 | |
| FreeBSD FreeBSD | =13.0-p3 | |
| FreeBSD FreeBSD | =13.0-p4 | |
| FreeBSD FreeBSD | =13.0-p5 | |
| FreeBSD FreeBSD | =13.0-p6 | |
| FreeBSD FreeBSD | =13.0-p7 | |
| FreeBSD FreeBSD | =13.0-p8 | |
| FreeBSD FreeBSD | =13.0-p9 | |
| FreeBSD FreeBSD | =13.0-rc1 | |
| FreeBSD FreeBSD | =13.0-rc2 | |
| FreeBSD FreeBSD | =13.0-rc3 | |
| FreeBSD FreeBSD | =13.0-rc4 | |
| FreeBSD FreeBSD | =13.0-rc5 | |
| FreeBSD FreeBSD | =13.0-rc5-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- agent/severity
- agent/last-modified-date
- agent/weakness
- vendor/freebsd
- canonical/freebsd freebsd
- version/freebsd freebsd/12.0
- version/freebsd freebsd/12.3
- version/freebsd freebsd/12.3-p1
- version/freebsd freebsd/12.3-p2
- version/freebsd freebsd/12.3-p3
- version/freebsd freebsd/12.3-p4
- version/freebsd freebsd/13.0
- version/freebsd freebsd/13.0-beta1
- version/freebsd freebsd/13.0-beta2
- version/freebsd freebsd/13.0-beta3
- version/freebsd freebsd/13.0-beta3-p1
- version/freebsd freebsd/13.0-beta4
- version/freebsd freebsd/13.0-p1
- version/freebsd freebsd/13.0-p10
- version/freebsd freebsd/13.0-p2
- version/freebsd freebsd/13.0-p3
- version/freebsd freebsd/13.0-p4
- version/freebsd freebsd/13.0-p5
- version/freebsd freebsd/13.0-p6
- version/freebsd freebsd/13.0-p7
- version/freebsd freebsd/13.0-p8
- version/freebsd freebsd/13.0-p9
- version/freebsd freebsd/13.0-rc1
- version/freebsd freebsd/13.0-rc2
- version/freebsd freebsd/13.0-rc3
- version/freebsd freebsd/13.0-rc4
- version/freebsd freebsd/13.0-rc5
- version/freebsd freebsd/13.0-rc5-p1