vulnwire
6.2med

CVE-2016-18851 exploit

Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
6.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
1
Exploit-DB

Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow.

Exploit prediction (EPSS)

1.20% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

Exploits and detections

  • EDB-39570 FreeBSD 10.2 (x64) - 'amd64_set_ldt' Heap Overflow · dos · 2016-03-16

CVSS scores

Assigned byVersionScoreVector
NVD3.06.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.04.9AV:L/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • exploit-db.com /exploits/39570/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • security.freebsd.org /advisories/FreeBSD-SA-16:15.sysarch.asc · vendor-advisory, x_refsource_FREEBSD, x_transferred
  • coresecurity.com /advisories/freebsd-kernel-amd64setldt-heap-overflow · x_refsource_MISC, x_transferred
  • seclists.org /fulldisclosure/2016/Mar/56 · mailing-list, x_refsource_FULLDISC, x_transferred
  • seclists.org /fulldisclosure/2016/Mar/67 · mailing-list, x_refsource_FULLDISC, x_transferred
  • securitytracker.com /id/1035309 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /archive/1/537813/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/537812/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • packetstormsecurity.com /files/136276/FreeBSD-Kernel-amd64_set_ldt-Heap-Overflow.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.