CVE-2022-23086: mpr/mps/mpt driver ioctl heap out-of-bounds write
Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small.
Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23086?
CVE-2022-23086 is classified as a medium severity vulnerability due to the potential for denial of service through heap memory corruption.
How do I fix CVE-2022-23086?
To mitigate CVE-2022-23086, users should update to the latest version of FreeBSD which addresses the vulnerability.
What components are affected by CVE-2022-23086?
CVE-2022-23086 affects the mpr, mps, and mpt drivers in FreeBSD.
Who is affected by CVE-2022-23086?
Any user with access to the mpr, mps, or mpt drivers in the specified FreeBSD versions is affected by CVE-2022-23086.
Is CVE-2022-23086 exploitable remotely?
CVE-2022-23086 may not be directly exploitable remotely but it can lead to local system stability issues.