high7.8Public exploit code
CVE-2016-1886
Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - 'SETFKEY' (PoC)2016-05-29 · dos · freebsd_x86-64
Impact
Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freebsd | Freebsd | Versions 9.3, 10.1, 10.2, 10.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://cturt.github.io/SETFKEY.html
- http://www.securityfocus.com/bid/90734
- http://www.securitytracker.com/id/1035905
- https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc
- http://cturt.github.io/SETFKEY.html
- http://www.securityfocus.com/bid/90734
- http://www.securitytracker.com/id/1035905
- https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc