CVE-2019-5601 Information disclosure in FreeBSD

Medium 6.5 Published 3 Jul 2019 Updated 4 Aug 2024

A bug in the FreeBSD FFS implementation leaks uninitialized kernel stack memory to disk, potentially exposing sensitive data to local attackers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5601?

CVE-2019-5601 is a medium-severity vulnerability in Freebsd Freebsd, published on 3 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the FFS implementation causes up to three bytes of kernel stack memory to be written to disk as uninitialized directory entry padding.

Weakness: CWE-200

Which versions are affected by CVE-2019-5601?

It affects 1 product.

Products include Freebsd Freebsd.

How do I fix CVE-2019-5601?

No fix has been published for CVE-2019-5601 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-5601 being exploited?

There is no known exploitation of CVE-2019-5601 in the wild and no public exploit code.

All Freebsd Freebsd vulnerabilities

Sources

Also known as GHSA-3qh4-83p4-2w86.