A vulnerability was found in FreeBSD up to 11.2/12.0 (Operating System). It has been classified as critical. Affected is an unknown code block of the component Unix Domain Socket Handler. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.

The weakness was presented 02/12/2019 (Website). The advisory is available at security.FreeBSD.org. This vulnerability is traded as CVE-2019-5596 since 01/07/2019. Local access is required to approach this attack. The requirement for exploitation is a authentication. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

A public exploit has been developed by Karsten König (gr4yf0x) in Bash and been published 12 months after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47829). See VDB-130757 for similar entry.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 11.0
• 11.1
• 11.2
• 12.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion