CVE-2014-8612
published 2015-02-02CVE-2014-8612: Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before…
PriorityP427medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
0.90%
55.0th percentile
Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
BSD
FreeBSD-SA-15:02.kmem: SCTP SCTP_SS_VALUE kernel memory corruption and disclosure
bsd_advisories·2015-01-27·CVSS 4.6
CVE-2014-8612 [MEDIUM] FreeBSD-SA-15:02.kmem: SCTP SCTP_SS_VALUE kernel memory corruption and disclosure
FreeBSD-SA-15:02.kmem Security Advisory
The FreeBSD Project
Topic: SCTP SCTP_SS_VALUE kernel memory corruption and disclosure
Category: core
Module: sctp
Announced: 2015-01-27
Credits: Clement LECIGNE from Google Security Team and
Francisco Falcon from Core Security Technologies
Affects: All supported versions of FreeBSD.
Corrected: 2015-01-27 19:36:08 UTC (stable/10, 10.1-STABLE)
2015-01-27 19:37:02 UTC (releng/10.1, 10.1-RELEASE-p5)
2015-01-27 19:37:02 UTC (releng/10.0, 10.0-RELEASE-p17)
2015-01-27 19:36:08 UTC (stable/9, 9.3-STABLE)
2015-01-27 19:37:02 UTC (releng/9.3, 9.3-RELEASE-p9)
2015-01-27 19:36:08 UTC (stable/8, 8.4-STABLE)
2015-01-27 19:37:02 UTC (releng/8.4, 8.4-RELEASE-p23)
CVE Name: CVE-2014-8612
For general information regarding FreeBSD Security Advisories,
including desc
GHSA
GHSA-cj67-c85m-hjw4: Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10
ghsa_unreviewed·2022-05-14
CVE-2014-8612 [MEDIUM] GHSA-cj67-c85m-hjw4: Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10
Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.
No detection rules found.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2015/Jan/107http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilitieshttp://www.securityfocus.com/archive/1/534563/100/0/threadedhttp://www.securityfocus.com/bid/72342http://www.securitytracker.com/id/1031648https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.aschttp://seclists.org/fulldisclosure/2015/Jan/107http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilitieshttp://www.securityfocus.com/archive/1/534563/100/0/threadedhttp://www.securityfocus.com/bid/72342http://www.securitytracker.com/id/1031648https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc
2015-02-02
Published