CVE-2025-0374 Unprivileged access to system files
An unprivileged local user can read encrypted passwords from temporary conflict files during system updates due to incorrect file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0374?
CVE-2025-0374 is a medium-severity vulnerability in FreeBSD, published on 30 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally have restricted visibility, such as /etc/master.passwd.
An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.
Weakness: CWE-732
Which versions are affected by CVE-2025-0374?
How do I fix CVE-2025-0374?
No fix has been published for CVE-2025-0374 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0374 being exploited?
There is no known exploitation of CVE-2025-0374 in the wild and no public exploit code.
Sources
Also known as GHSA-2ffg-9hw7-35q4.