CVE-2023-5368

msdosfs data disclosure

State: Published
Severity: Not scored
Published: Oct 4, 2023
Updated: Aug 2, 2024
Reserved: Oct 3, 2023

Description

On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.

This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).

Scores

The record has no CVSS score.

Weaknesses

CWE-1188 Insecure Default Initialization of Resource

Affected Products

Product	Versions
FreeBSDFreeBSD	13.2-RELEASE to before p4Affected 12.4-RELEASE to before p6Affected

References

https://security.freebsd.org/advisories/FreeBSD-SA-23:12.msdosfs.ascvendor-advisory
https://security.netapp.com/advisory/ntap-20231124-0004/
https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.