FreeBSD up to 11.2/11.3/12.0 Midi memory corruption

Summaryinfo

A vulnerability was found in FreeBSD up to 11.2/11.3/12.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component Midi Handler. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2019-5612. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in FreeBSD up to 11.2/11.3/12.0 (Operating System). This affects an unknown function of the component Midi Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.

The weakness was shared 08/20/2019 as FreeBSD-SA-19:23.midi as confirmed security advisory (Website). The advisory is shared at lists.freebsd.org. This vulnerability is uniquely identified as CVE-2019-5612 since 01/07/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The advisory points out:

The kernel driver for /dev/midistat implements a handler for read(2). This handler is not thread-safe, and a multi-threaded program can exploit races in the handler to cause it to copy out kernel memory outside the boundaries of midistat's data buffer.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at security.freebsd.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The security advisory contains the following remark:

No workaround is available. Custom kernels without "device sound" are not vulnerable.

The entry VDB-140888 is related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 12.0

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion