CVE-2019-5611 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check in the function to arrange data in a chain of mbufs could cause data returned not to be contiguous. Extra checks in the IPv6 stack could catch the error condition and trigger a kernel panic, leading to a remote denial of service.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Freebsd	Freebsd	11.2
Netapp	Clustered Data Ontap	-

Related Weaknesses (CWE)

CWE-20

References

http://packetstormsecurity.com/files/154170/FreeBSD-Security-Advisory-FreeBSD-SAExploitPatchThird Party Advisory
https://seclists.org/bugtraq/2019/Aug/33ExploitMailing ListPatch
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.ascPatchVendor Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.ascPatchVendor Advisory
https://security.netapp.com/advisory/ntap-20190910-0002/Third Party Advisory
http://packetstormsecurity.com/files/154170/FreeBSD-Security-Advisory-FreeBSD-SAExploitPatchThird Party Advisory
https://seclists.org/bugtraq/2019/Aug/33ExploitMailing ListPatch
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.ascPatchVendor Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.ascPatchVendor Advisory
https://security.netapp.com/advisory/ntap-20190910-0002/Third Party Advisory

FAQ

What is CVE-2019-5611?

CVE-2019-5611 is a vulnerability with a CVSS score of 7.5 (HIGH). In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check ...

How severe is CVE-2019-5611?

CVE-2019-5611 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-5611?

Check the references section above for vendor advisories and patch information. Affected products include: Freebsd Freebsd, Netapp Clustered Data Ontap.