Vulnerability Details : CVE-2019-5603
In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, system calls operating on file descriptors as part of mqueuefs did not properly release the reference allowing a malicious user to overflow the counter allowing access to files, directories, and sockets opened by processes owned by other users.
Products affected by CVE-2019-5603
- cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.3:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p7:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p7:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p9:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:rc3:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p10:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.0:-:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p8:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:11.2:p11:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-5603
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-5603
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-5603
-
The product does not release or incorrectly releases a resource before it is made available for re-use.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-5603
-
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:24.mqueuefs.asc
Third Party Advisory
-
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:15.mqueuefs.asc
Vendor Advisory
-
https://seclists.org/bugtraq/2019/Aug/35
Bugtraq: FreeBSD Security Advisory FreeBSD-SA-19:24.mqueuefsBroken Link
-
https://security.netapp.com/advisory/ntap-20190814-0003/
August 2019 FreeBSD Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
http://packetstormsecurity.com/files/153752/FreeBSD-Security-Advisory-FreeBSD-SA-19-15.mqueuefs.html
FreeBSD Security Advisory - FreeBSD-SA-19:15.mqueuefs ≈ Packet StormThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/154172/FreeBSD-Security-Advisory-FreeBSD-SA-19-24.mqueuefs.html
FreeBSD Security Advisory - FreeBSD-SA-19:24.mqueuefs ≈ Packet StormThird Party Advisory;VDB Entry
Jump to