Vulnerability Description
When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Freebsd | Freebsd | < 12.3 |
Related Weaknesses (CWE)
References
- https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.ascVendor Advisory
- https://security.netapp.com/advisory/ntap-20240415-0006/Third Party Advisory
- https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.ascVendor Advisory
- https://security.netapp.com/advisory/ntap-20240415-0006/Third Party Advisory
FAQ
What is CVE-2022-23089?
CVE-2022-23089 is a vulnerability with a CVSS score of 4.7 (MEDIUM). When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user cons...
How severe is CVE-2022-23089?
CVE-2022-23089 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-23089?
Check the references section above for vendor advisories and patch information. Affected products include: Freebsd Freebsd.