CVE-2014-8476 Information disclosure in n/a

Low 2.1 Published 13 Nov 2014 Updated 6 Aug 2024

Local attackers can read uninitialized kernel memory via getlogin, exposing sensitive information from the FreeBSD kernel.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8476?

CVE-2014-8476 is a low-severity vulnerability in Freebsd Freebsd, published on 13 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.

Weakness: CWE-200

Which versions are affected by CVE-2014-8476?

It affects 1 product.

Products include Freebsd Freebsd.

How do I fix CVE-2014-8476?

Apply the vendor's patch.

Is CVE-2014-8476 being exploited?

There is no known exploitation of CVE-2014-8476 in the wild and no public exploit code.

All Freebsd Freebsd vulnerabilities

Sources

Also known as GHSA-h9p4-8w88-cwc7.