CVE-2013-5666

Published: Sep 23, 2013Modified: Apr 29, 2026

4.7

Vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Exploitability: 3.4 / Impact: 6.9

Source: NVD

Description

The sendfile system-call implementation in sys/kern/uipc_syscalls.c in the kernel in FreeBSD 9.2-RC1 and 9.2-RC2 does not properly pad transmissions, which allows local users to obtain sensitive information (kernel memory) via a length greater than the length of the file.

Affected (2)

Products: Freebsd: Freebsd

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 9.2 rc1
Freebsd Freebsd	Version 9.2 rc2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://osvdb.org/97142

Source: cve@mitre.org

http://svnweb.freebsd.org/base?view=revision&revision=255442

Source: cve@mitre.org

http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a11.sendfile.asc

Source: cve@mitre.org

Vendor Advisory

http://www.securitytracker.com/id/1029013

Source: cve@mitre.org

http://osvdb.org/97142

Source: af854a3a-2127-422b-91ae-364da2661108

http://svnweb.freebsd.org/base?view=revision&revision=255442

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.freebsd.org/security/advisories/FreeBSD-SA-13%3a11.sendfile.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securitytracker.com/id/1029013

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.