MNBSD-2021-0: Uninitialized kernel stack disclosures in several file systems

Description

Several file systems failed to properly initialize memory before copying it to userland. Uninitialized kernel stack disclosures in tmpfs, smbfs, autofs and mqueuefs (CVE-2020-25578), and an uninitialized padding field in msdosfs (CVE-2020-25579), could leak sensitive kernel information to userspace, which may be used to help compromise the system.

Affected Versions

kernel

Recommendations

No specific recommendations provided.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-21:01.fsdisclosure.asc
• https://www.cve.org/CVERecord?id=CVE-2020-25578
• https://www.cve.org/CVERecord?id=CVE-2020-25579

Additional Information

Aliases: CVE-2020-25578, CVE-2020-25579

Published: January 29, 2021
Last Modified: January 29, 2021