CVE-2017-1088

Vulnerability

The kldstat(2) syscall in FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 does not zero the kld_file_stat structure allocated on the kernel stack before copying it to userspace. This results in an information leak where uninitialized kernel stack bytes are exposed to userland processes. [1]

Exploitation

An attacker with the ability to invoke the kldstat(2) syscall (i.e., any user with appropriate permissions) can trigger the leak. No special privileges or user interaction beyond executing the syscall are required. The attacker reads the returned structure to observe residual kernel stack data. [1]

Impact

A local attacker can obtain sensitive kernel stack contents, potentially revealing information such as addresses or other data that could aid in further exploitation. The leak is limited to the size of the kld_file_stat structure and depends on what data resides on the stack at the time of the syscall. [1]

Mitigation

FreeBSD has released patches for all supported versions: 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24. No workaround is available. Users should upgrade to the patched versions. [1]