CVE-2025-0662 Uninitialized kernel memory disclosure via ktrace(2)
An unprivileged user can leak up to 14 bytes of uninitialized kernel memory via the ktrace facility, potentially exposing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0662?
CVE-2025-0662 is a medium-severity vulnerability in FreeBSD, published on 30 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to userspace. There, the full sockaddr is copied, even when it is shorter than the full size. This can result in up to 14 uninitialized bytes of kernel memory being copied out to userspace.
It is possible for an unprivileged userspace program to leak 14 bytes of a kernel heap allocation to userspace.
Weakness: CWE-122
Which versions are affected by CVE-2025-0662?
How do I fix CVE-2025-0662?
No fix has been published for CVE-2025-0662 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0662 being exploited?
There is no known exploitation of CVE-2025-0662 in the wild and no public exploit code.
Sources
Also known as GHSA-942x-h2h3-8wxm.