CVE-2019-15880 - In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic

Back Back to CVE browser

CRITICAL

In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic

Published May 13, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.54%

Description

In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.

Affected products

Vendor n/a Product FreeBSD Default
n/a
- Version
  FreeBSD 12.1-RELEASE before p5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

FreeBSD

n/a

Version	Status	Constraints
FreeBSD 12.1-RELEASE before p5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-20

Improper Input Validation

References (2)

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:16.cryptodev.asc
x_refsource_MISCVendor Advisory
https://security.netapp.com/advisory/ntap-20200518-0008/
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:16.cryptodev.asc		x_refsource_MISCVendor Advisory
https://security.netapp.com/advisory/ntap-20200518-0008/		x_refsource_CONFIRMThird Party Advisory