Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

FreeBSD may leak kernel memory to local users

CVE-2018-6920 · published 8 years ago
Summary

Certain older versions of FreeBSD can accidentally expose tiny pieces of the operating system’s core memory to programs running on the system. This could allow a regular user who has logged in to view data that should be protected. Updating FreeBSD to the latest release patches the problem and stops the leakage.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
freebsd freebsd >= 10.0, < 10.4
>= 11.0, < 11.1
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Original advisory text
In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to userland in the Linux subsystem and Ather...
In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to userland in the Linux subsystem and Atheros wireless driver, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts of privileged kernel data.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published8 May 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-6920 · NVD
Track software like this
Free during beta