CVE-2017-1088

Published: Nov 16, 2017Modified: May 13, 2026

3.3

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible. As a result, some bytes from the kernel stack can be observed in userspace.

Affected (1)

Products: Freebsd: Freebsd

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	All versions

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.securityfocus.com/bid/101857

Source: secteam@freebsd.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039811

Source: secteam@freebsd.org

Third Party AdvisoryVDB Entry

https://www.freebsd.org/security/advisories/FreeBSD-SA-17:10.kldstat.asc

Source: secteam@freebsd.org

Vendor Advisory

http://www.securityfocus.com/bid/101857

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039811

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.freebsd.org/security/advisories/FreeBSD-SA-17:10.kldstat.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.