Security Update for kfreebsd-9
Summary
DSA-2952-1: kfreebsd-9 - security update. Affects kfreebsd-9 versions < 9.0-10+deb70.7. Fixed in 9.0-10+deb70.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
kfreebsd-9 is a package in the Debian ecosystem that provides the FreeBSD kernel for the Debian GNU/kFreeBSD operating system. It is responsible for managing the core functionality of the operating system, including memory management, process scheduling, and device drivers. This package is vulnerable to multiple security issues that could lead to denial of service or disclosure of sensitive information.
Vulnerability Detail
The vulnerabilities in kfreebsd-9 include:
-
CVE-2014-1453: A remote, authenticated attacker can cause the NFS server to become deadlocked, resulting in a denial of service.
-
CVE-2014-3000: An attacker who can send a series of specifically crafted packets with a connection can cause the kernel to crash, leading to a denial of service.
-
CVE-2014-3880: A local attacker can trigger a kernel crash (triple fault) with potential data loss, related to the execve/fexecve system calls. This vulnerability can be exploited to cause a denial of service.
Additionally, there is a possibility of sensitive information disclosure through a carefully crafted attack that overwrites undefined on-stack memory via a connected socket.
How To Fix
Minimum fixed version
9.0-10+deb70.7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kfreebsd-9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the kfreebsd-9 package to the fixed versions will address the vulnerabilities and ensure the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kfreebsd-9 →
FAQ
kfreebsd-9 is a package in the Debian ecosystem that provides the FreeBSD kernel for the Debian GNU/kFreeBSD operating system.
The vulnerabilities in kfreebsd-9 include CVE-2014-1453, CVE-2014-3000, and CVE-2014-3880. These vulnerabilities can lead to denial of service or disclosure of sensitive information.
An attacker can exploit these vulnerabilities by causing the NFS server to become deadlocked, sending specifically crafted packets to crash the kernel, or triggering a kernel crash with potential data loss through the execve/fexecve system calls. Additionally, an attacker can attempt to disclose sensitive information by overwriting on-stack memory via a connected socket.
The impact of these vulnerabilities can range from denial of service, potential data loss, to the disclosure of sensitive information such as login credentials.
To fix these vulnerabilities, it is recommended to upgrade the kfreebsd-9 package to the fixed versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for kfreebsd-9.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
