CVE-2022-23086 (GCVE-0-2022-23086)

Vulnerability from cvelistv5 – Published: 2024-02-15 04:57 – Updated: 2025-02-13 16:28
VLAI
Title
mpr/mps/mpt driver ioctl heap out-of-bounds write
Summary
Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 13.1-RC1 , < p1 (release)
Affected: 13.0-RELEASE , < p11 (release)
Affected: 12.3-RELEASE , < p5 (release)
Create a notification for this product.
freebsd freebsd Affected: 13.1-rc1 , < 13.1_p1 (custom)
Affected: 13.0 , < 13.0_p11 (custom)
Affected: 12.3 , < 12.0_p5 (custom)
    cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2022-04-06 05:00
Credits
Lucas Leong (@_wmliang_) Trend Micro Zero Day Initiative
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:43.508Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240419-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "13.1_p1",
                "status": "affected",
                "version": "13.1-rc1",
                "versionType": "custom"
              },
              {
                "lessThan": "13.0_p11",
                "status": "affected",
                "version": "13.0",
                "versionType": "custom"
              },
              {
                "lessThan": "12.0_p5",
                "status": "affected",
                "version": "12.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-23086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-28T19:55:52.135859Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "CWE-122 Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T19:55:55.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "mpr",
            "mps",
            "mpt"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p1",
              "status": "affected",
              "version": "13.1-RC1",
              "versionType": "release"
            },
            {
              "lessThan": "p11",
              "status": "affected",
              "version": "13.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p5",
              "status": "affected",
              "version": "12.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Lucas Leong (@_wmliang_)"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Trend Micro Zero Day Initiative"
        }
      ],
      "datePublic": "2022-04-06T05:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header.  Other heap content would be overwritten if the specified size was too small.\n\nUsers with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation.  Note that the device node is only accessible to root and members of the operator group."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T07:06:05.655Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240419-0002/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "mpr/mps/mpt driver ioctl heap out-of-bounds write",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2022-23086",
    "datePublished": "2024-02-15T04:57:19.622Z",
    "dateReserved": "2022-01-10T22:07:46.040Z",
    "dateUpdated": "2025-02-13T16:28:59.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-23086",
      "date": "2026-06-30",
      "epss": "0.00447",
      "percentile": "0.35661"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-23086\",\"sourceIdentifier\":\"secteam@freebsd.org\",\"published\":\"2024-02-15T05:15:09.273\",\"lastModified\":\"2026-06-17T04:29:28.750\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header.  Other heap content would be overwritten if the specified size was too small.\\n\\nUsers with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation.  Note that the device node is only accessible to root and members of the operator group.\"},{\"lang\":\"es\",\"value\":\"Los controladores para *_CFG_PAGE lectura/escritura ioctls en los controladores mpr, mps y mpt asignaron un b\u00fafer de un tama\u00f1o especificado por la persona que llama, pero copiaron en \u00e9l un encabezado de tama\u00f1o fijo. Otro contenido del mont\u00f3n se sobrescribir\u00eda si el tama\u00f1o especificado fuera demasiado peque\u00f1o. Los usuarios con acceso al nodo del dispositivo mpr, mps o mpt pueden sobrescribir los datos del mont\u00f3n, lo que podr\u00eda provocar una escalada de privilegios. Tenga en cuenta que solo el usuario ra\u00edz y los miembros del grupo de operadores pueden acceder al nodo del dispositivo.\"}],\"affected\":[{\"source\":\"secteam@freebsd.org\",\"affectedData\":[{\"vendor\":\"FreeBSD\",\"product\":\"FreeBSD\",\"defaultStatus\":\"unknown\",\"modules\":[\"mpr\",\"mps\",\"mpt\"],\"versions\":[{\"version\":\"13.1-RC1\",\"lessThan\":\"p1\",\"versionType\":\"release\",\"status\":\"affected\"},{\"version\":\"13.0-RELEASE\",\"lessThan\":\"p11\",\"versionType\":\"release\",\"status\":\"affected\"},{\"version\":\"12.3-RELEASE\",\"lessThan\":\"p5\",\"versionType\":\"release\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"freebsd\",\"product\":\"freebsd\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"13.1-rc1\",\"lessThan\":\"13.1_p1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"13.0\",\"lessThan\":\"13.0_p11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"12.3\",\"lessThan\":\"12.0_p5\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-28T19:55:52.135859Z\",\"id\":\"CVE-2022-23086\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0\",\"versionEndExcluding\":\"12.3\",\"matchCriteriaId\":\"E4497B7F-A3CF-43BD-B7AA-9D6D83612B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"224B7627-CDDE-429A-852F-8A6066B501B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B6DCD8A-331E-419F-9253-C4D35C1DF54B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4578E06C-16C6-435E-9E51-91CB02602355\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"71FA1F6C-7E53-40F8-B9E1-5FD28D5DAADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EC87BCE-17F0-479B-84DC-516C24FBD396\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"174265E7-6B73-4546-B4C7-3826C7EB5624\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7412DBD8-BB1F-48A8-AAE1-BA5C8D7BDDF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"833DFF5B-BC50-424A-ABCF-EC632F421B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F27016E-4117-4094-BB7A-9C56E38024D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC7326E3-908D-47A1-B848-3AA7F34B3DD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B149BF69-951D-47B4-996C-9E4773DA75B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"04A0E266-714C-4753-A652-A51F25582C78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:*\",\"matchCriteriaId\":\"D133E8E0-4E88-451C-9693-5DE5C3092AD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"556111A1-C236-4DF6-9438-F9C874451A58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1673F16B-463A-492C-B66F-48917008F7F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E73B211F-2CA9-47A4-B318-F24CC1C7E589\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C13DDEF-FF5F-4723-9C25-4EA66AE2CEDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A942EA9-0DD3-44BC-B582-C680BA34E88F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"689BC10B-0404-4468-B604-9D96337F9BD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"38DDAA43-3E9C-479F-8416-E3B9BE23C31B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE490480-1EA1-4684-A643-9749E87A8448\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC271C93-EB83-4301-B7BA-F3249B71B1EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"04329338-AC28-4A74-BE6B-CE8EC6CC37B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADBA841F-5C83-4759-84B7-B59DA1B12EA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A8F38B3-A6DA-4178-A2BD-0D4F0267C384\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BB028A0-70F6-42DA-9E5A-F7AAF74ED45B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"00D28E4E-022B-482E-9952-7F7F47C427C2\"}]}]}],\"references\":[{\"url\":\"https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc\",\"source\":\"secteam@freebsd.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240419-0002/\",\"source\":\"secteam@freebsd.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240419-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240419-0002/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T03:28:43.508Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-23086\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T19:55:52.135859Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*\"], \"vendor\": \"freebsd\", \"product\": \"freebsd\", \"versions\": [{\"status\": \"affected\", \"version\": \"13.1-rc1\", \"lessThan\": \"13.1_p1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"13.0\", \"lessThan\": \"13.0_p11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"12.3\", \"lessThan\": \"12.0_p5\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122 Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T19:55:05.827Z\"}}], \"cna\": {\"title\": \"mpr/mps/mpt driver ioctl heap out-of-bounds write\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Lucas Leong (@_wmliang_)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Trend Micro Zero Day Initiative\"}], \"affected\": [{\"vendor\": \"FreeBSD\", \"modules\": [\"mpr\", \"mps\", \"mpt\"], \"product\": \"FreeBSD\", \"versions\": [{\"status\": \"affected\", \"version\": \"13.1-RC1\", \"lessThan\": \"p1\", \"versionType\": \"release\"}, {\"status\": \"affected\", \"version\": \"13.0-RELEASE\", \"lessThan\": \"p11\", \"versionType\": \"release\"}, {\"status\": \"affected\", \"version\": \"12.3-RELEASE\", \"lessThan\": \"p5\", \"versionType\": \"release\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2022-04-06T05:00:00.000Z\", \"references\": [{\"url\": \"https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240419-0002/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header.  Other heap content would be overwritten if the specified size was too small.\\n\\nUsers with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation.  Note that the device node is only accessible to root and members of the operator group.\"}], \"providerMetadata\": {\"orgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"shortName\": \"freebsd\", \"dateUpdated\": \"2024-04-19T07:06:05.655Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-23086\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T16:28:59.871Z\", \"dateReserved\": \"2022-01-10T22:07:46.040Z\", \"assignerOrgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"datePublished\": \"2024-02-15T04:57:19.622Z\", \"assignerShortName\": \"freebsd\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.