Summaryinfo

A vulnerability has been found in FreeBSD 11.3/12.1 and classified as critical. This affects an unknown part of the component cryptodev. This manipulation causes race condition (Kernel Memory). The identification of this vulnerability is CVE-2019-15879. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as very critical was found in FreeBSD 11.3/12.1 (Operating System). Affected by this vulnerability is an unknown part of the component cryptodev. The manipulation with an unknown input leads to a race condition vulnerability (Kernel Memory). The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.

The weakness was shared 05/13/2020. This vulnerability is known as CVE-2019-15879 since 09/03/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/14/2020).

Applying a patch is able to eliminate this problem.

The entries VDB-155180 and VDB-155178 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Name

• FreeBSD

Version

• 11.3
• 12.1

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion