Bug 492734 – sys-freebsd/freebsd-sources: Information leak (CVE-2013-{6832,6833,6834})

• Status: RESOLVED WONTFIX
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2013-11-27 21:42:50 UTC]

CVE-2013-6834 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6834):
  The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD
  10 and earlier does not validate a certain size parameter, which allows
  local users to obtain sensitive information from kernel memory via a crafted
  ioctl call.

CVE-2013-6833 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6833):
  The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in
  FreeBSD 10 and earlier does not validate a certain size parameter, which
  allows local users to obtain sensitive information from kernel memory via a
  crafted ioctl call.

CVE-2013-6832 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6832):
  The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in
  the kernel in FreeBSD 10 and earlier does not properly initialize a certain
  data structure, which allows local users to obtain sensitive information
  from kernel memory via a crafted ioctl call.

[Comment 1 Naohiro Aota 2013-11-30 13:22:42 UTC]

9.1 seems not to be affected.

[Comment 2 Aaron Bauman (RETIRED) 2016-11-26 01:06:44 UTC]

FreeBSD sources are not supported by the security team.