Riskcovery

CVE-2022-23085

Potential jail escape vulnerabilities in netmap

State
Published
Severity
9.8 Critical
Published
Feb 15, 2024
Updated
Feb 13, 2025
Reserved
Jan 10, 2022

Read the record on cve.org

Description

A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

ProductVersions
FreeBSDFreeBSD
  • 13.1-RC1 to before p1Affected
  • 13.0-RELEASE to before p11Affected
  • 12.3-RELEASE to before p5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.