CVE-2019-5608 Memory corruption in FreeBSD
A remote attacker can cause a kernel panic via crafted ICMPv6 packets, leading to denial of service on FreeBSD systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5608?
CVE-2019-5608 is a critical memory corruption vulnerability in Freebsd Freebsd, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently panic.
Which versions are affected by CVE-2019-5608?
It affects 2 products.
Products include Freebsd Freebsd, Netapp Clustered Data Ontap.
How do I fix CVE-2019-5608?
No fix has been published for CVE-2019-5608 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-5608 being exploited?
There is no known exploitation of CVE-2019-5608 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-m5pq-g347-cqr6.