Privilege Escalation and Information Leak in kfreebsd-9
Summary
DSA-2743-1: kfreebsd-9 - several. Affects kfreebsd-9 versions < 9.0-10+deb70.3. Fixed in 9.0-10+deb70.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
kfreebsd-9 is a package in the Debian ecosystem that provides the FreeBSD kernel for the Debian GNU/kFreeBSD operating system. It is responsible for managing the core functionality of the operating system, including memory management, process scheduling, and device drivers. This package is vulnerable to multiple security issues that can lead to privilege escalation or information leaks.
Vulnerability Detail
The vulnerabilities in kfreebsd-9 are as follows:
-
CVE-2013-3077: An integer overflow in the IP multicast code can result in a buffer that is too small for the requested operation. This allows an unprivileged process to read or write kernel memory, potentially exposing sensitive information or escalating privileges.
-
CVE-2013-4851: The kernel incorrectly uses client-supplied credentials instead of the configured ones when filling out the anonymous credential for a NFS export. This allows a remote client to supply privileged credentials, bypassing normal access checks.
-
CVE-2013-5209: When initializing the SCTP state cookie sent in INIT-ACK chunks, a buffer allocated from the kernel stack is not completely initialized. This can result in fragments of kernel memory being included in SCTP packets and transmitted over the network, potentially exposing sensitive information or facilitating privilege escalation.
How To Fix
Minimum fixed version
9.0-10+deb70.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kfreebsd-9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The kfreebsd-9 package in the Debian ecosystem is vulnerable to privilege escalation and information leaks due to multiple security issues. It is crucial to upgrade to the fixed version of the package to mitigate these vulnerabilities. For more information and support, please contact DevNack.com.
See every vulnerability recorded for kfreebsd-9 →
FAQ
These vulnerabilities can lead to privilege escalation, information leaks, and bypassing of access checks, potentially exposing sensitive information or allowing unauthorized access to system resources.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade to the fixed version of the package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities in real-time.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-2743-1 (https://security-tracker.debian.org/tracker/DSA-2743-1).
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for kfreebsd-9.
