CVE-2023-5368 msdosfs data disclosure
A local attacker with write access to an msdosfs filesystem can read unallocated disk data via truncate operations, potentially exposing sensitive information from deleted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5368?
CVE-2023-5368 is a medium-severity vulnerability in Freebsd Freebsd, published on 4 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.
This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).
Weakness: CWE-1188
Which versions are affected by CVE-2023-5368?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2023-5368?
No fix has been published for CVE-2023-5368 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5368 being exploited?
There is no known exploitation of CVE-2023-5368 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-mxp6-gc8g-j2p9.