CVE-2019-5601

moderate-risk

Published 2019-07-03

In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the FFS implementation causes up to three bytes of kernel stack memory to be written to disk as uninitialized directory entry padding.

Do I need to act?

0.29% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (17)

Freebsd

Affected Vendors

Freebsd

References (4)

Third Party Advisory http://packetstormsecurity.com/files/153523/FreeBSD-Security-Advisory-FreeBSD-SA...

Vendor Advisory https://security.FreeBSD.org/advisories/FreeBSD-SA-19:10.ufs.asc

Third Party Advisory http://packetstormsecurity.com/files/153523/FreeBSD-Security-Advisory-FreeBSD-SA...

Vendor Advisory https://security.FreeBSD.org/advisories/FreeBSD-SA-19:10.ufs.asc

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 19/34 · Moderate