CVE-2020-25579

moderate-risk
Published 2021-03-26

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

Do I need to act?

-
0.34% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Freebsd

References (4)

Vendor Advisory https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc
Third Party Advisory https://security.netapp.com/advisory/ntap-20210423-0002/
Vendor Advisory https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc
Third Party Advisory https://security.netapp.com/advisory/ntap-20210423-0002/
43
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 1/34 · Minimal
Exposure 21/34 · High