CVE-2013-5666

La implementación de la llamada de sistema sendfile en el archivo sys/kern/uipc_syscalls.c en el kernel en FreeBSD versiones 9.2-RC1 y 9.2-RC2 no completa apropiadamente las transmisiones, lo que permite a los usuarios locales obtener información confidencial (memoria del kernel) mediante una longitud mayor que la longitud del archivo.

The sendfile(2) system call allows a server application (such as an HTTP or FTP server) to transmit the contents of a file over a network connection without first copying it to application memory. High performance servers such as Apache and ftpd use sendfile. On affected systems, if the length passed to sendfile(2) is non-zero and greater than the length of the file being transmitted, sendfile(2) will pad the transmission up to the requested length or the next pagesize boundary, whichever is smaller. The content of the additional bytes transmitted in this manner depends on the underlying filesystem, but may potentially include information useful to an attacker. An unprivileged user with the ability to run arbitrary code may be able to obtain arbitrary kernel memory contents.