CVE-2019-5612 Race condition in FreeBSD
A race condition in the FreeBSD kernel's midistat driver allows local attackers to read kernel memory outside intended boundaries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5612?
CVE-2019-5612 is a high-severity vulnerability in Freebsd Freebsd, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.
Weakness: CWE-362
Which versions are affected by CVE-2019-5612?
It affects 2 products.
Products include Freebsd Freebsd, Netapp Clustered Data Ontap.
How do I fix CVE-2019-5612?
No fix has been published for CVE-2019-5612 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5612 being exploited?
There is no known exploitation of CVE-2019-5612 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-5hj2-hcr5-w3xf.