CVSS: 9.8EPSS: 0%CPEs: 19EXPL: 0CVE-2023-3326 – Network authentication attack via pam_krb5
https://notcve.org/view.php?id=CVE-2023-3326
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system. • https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc https://security.netapp.com/advisory/ntap-20230714-0005 • CWE-287: Improper Authentication CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 5.5EPSS: 0%CPEs: 23EXPL: 0CVE-2021-29626
https://notcve.org/view.php?id=CVE-2021-29626
In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel. En FreeBSD versiones 13.0-STABLE anteriores a n245117, versiones 12.2-STABLE anteriores a r369551, versiones 11.4-STABLE anteriores a r369559, versiones 13.0-RC5 anteriores a p1, versiones 12.2-RELEASE anteriores a p6 y versiones 11.4-RELEASE anteriores a p9, la lógica de copy-on-write fallaba al invalidar las asignaciones de páginas de memoria compartida entre múltiples procesos, permitiendo que un proceso sin privilegios mantuviera una asignación después de ser liberada, permitiendo que el proceso leyera datos privados pertenecientes a otros procesos o al kernel • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:08.vm.asc https://security.netapp.com/advisory/ntap-20210423-0008 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2020-25584
https://notcve.org/view.php?id=CVE-2020-25584
In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail. En FreeBSD versiones 13.0-STABLE anteriores a n245118, versiones 12.2-STABLE anteriores a r369552, versiones 11.4-STABLE anteriores a r369560, versiones 13.0-RC5 anteriores a p1, versiones 12.2-RELEASE anteriores a p6 y versiones 11.4-RELEASE anteriores a p9, un superusuario dentro de una jaula FreeBSD configurada con el permiso por defecto allow.mount podría causar una condición de carrera entre la búsqueda de ".." y volver a montar un sistema de archivos, permitiendo el acceso a la jerarquía del sistema de archivos fuera de jail • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc https://security.netapp.com/advisory/ntap-20210423-0009 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.2EPSS: 0%CPEs: 49EXPL: 1CVE-2020-24718
https://notcve.org/view.php?id=CVE-2020-24718
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP. bhyve, como es usado en FreeBSD versiones hasta 12.1 e illumos (por ejemplo, OmniOS CE versiones hasta r151034 y OpenIndiana versiones hasta Hipster 2020.04), no restringe apropiadamente las operaciones de lectura y de escritura de VMCS y VMCB, como es demostrado por un usuario root en un contenedor en un sistema Intel, quién puede alcanzar privilegios al modificar VMCS_HOST_RIP • https://github.com/illumos/illumos-gate/blob/84971882a96ac0fecd538b02208054a872ff8af3/usr/src/uts/i86pc/io/vmm/intel/vmcs.c#L246-L249 https://security.FreeBSD.org/advisories/FreeBSD-SA-20:28.bhyve_vmcs.asc https://security.netapp.com/advisory/ntap-20201016-0002 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 2CVE-2020-24863
https://notcve.org/view.php?id=CVE-2020-24863
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode. Se encontró una vulnerabilidad de corrupción de memoria en la función del kernel kern_getfsstat en MidnightBSD versiones anteriores a 1.2.7 y versiones 1.3 hasta el19-08-2020, y FreeBSD versiones hasta 11.4, que permite a un atacante desencadenar una liberación no válida y bloquear el sistema por medio de un valor de tamaño diseñado en conjunto con un modo no válido • http://www.midnightbsd.org/security/adv/MIDNIGHTBSD-SA-20:01.txt https://github.com/MidnightBSD/src/blob/1691c07ff4f27b97220a5d65e217341e477f4014/sys/kern/vfs_syscalls.c https://www.freebsd.org/security/advisories/FreeBSD-EN-20:18.getfsstat.asc https://www.midnightbsd.org/notes • CWE-787: Out-of-bounds Write •