CVE-2019-5612 - In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe

Back Back to CVE browser

HIGH

In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe

Published Aug 29, 2019

7.5

HIGH

CVSS 3.1

EPSS 0.91%

Description

In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.

Affected products

Vendor n/a Product FreeBSD Default
n/a
- Version
  before 11.2-RELEASE-p14
  Status
  affected
  Constraints
  -
- Version
  before 11.3-RELEASE-p3
  Status
  affected
  Constraints
  -
- Version
  before 12.0-RELEASE-p10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

FreeBSD

n/a

Version	Status	Constraints
before 11.2-RELEASE-p14	affected	-
before 11.3-RELEASE-p3	affected	-
before 12.0-RELEASE-p10	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (2)

https://security.FreeBSD.org/advisories/FreeBSD-SA-19:23.midi.asc
x_refsource_CONFIRMMitigationVendor Advisory
https://security.netapp.com/advisory/ntap-20190910-0002/
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:23.midi.asc		x_refsource_CONFIRMMitigationVendor Advisory
https://security.netapp.com/advisory/ntap-20190910-0002/		x_refsource_CONFIRMThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner freebsd

Published Aug 29, 2019

Updated Aug 4, 2024

Reserved Jan 7, 2019

Link CVE-2019-5612

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-5612

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-5612