{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6660", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2023-12-11T02:57:26.026Z", "datePublished": "2023-12-13T08:23:40.149Z", "dateUpdated": "2024-08-02T08:35:14.831Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["nfsclient"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p3", "status": "affected", "version": "14.0-RELEASE", "versionType": "release"}, {"lessThan": "p8", "status": "affected", "version": "13.2-RELEASE", "versionType": "release"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Hostpoint AG"}], "datePublic": "2023-12-12T19:00:00.000Z", "descriptions": [{"lang": "en", "value": "When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be written but proceed as though the copy operation had succeeded. This means that the data to be written is instead replaced with whatever data had been in the packet buffer previously. Thus, an unprivileged user with access to an affected system may abuse the bug to trigger disclosure of sensitive information. In particular, the leak is limited to data previously stored in mbufs, which are used for network transmission and reception, and for certain types of inter-process communication.\n\nThe bug can also be triggered unintentionally by system applications, in which case the data written by the application to an NFS mount may be corrupted. Corrupted data is written over the network to the NFS server, and thus also susceptible to being snooped by other hosts on the network.\n\nNote that the bug exists only in the NFS client; the version and implementation of the server has no effect on whether a given system is affected by the problem."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2023-12-13T08:23:40.149Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-23:18.nfsclient.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240322-0002/"}], "source": {"discovery": "UNKNOWN"}, "title": "NFS client data corruption and kernel memory disclosure", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:35:14.831Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-23:18.nfsclient.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240322-0002/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*", "matchCriteriaId": "A87EFA20-DD6B-41C5-98FD-A29F67D2E732", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*", "matchCriteriaId": "2888B0C1-4D85-42EC-9696-03FAD0A9C28F", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*", "matchCriteriaId": "A3306F11-D3C0-41D6-BB5E-2ABDC3927715", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*", "matchCriteriaId": "9E584FE1-3A34-492B-B10F-508DA7CBA768", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*", "matchCriteriaId": "A5605E90-D125-4CC9-8B9F-F5EED9D4EE0C", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*", "matchCriteriaId": "761B4382-E857-4868-9F80-189B7F60256B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*", "matchCriteriaId": "51B17801-15FD-4425-BA6C-BE06B14F1BFE", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*", "matchCriteriaId": "E9CAFF74-AD36-4D29-83F3-23E0417C485D", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*", "matchCriteriaId": "FA25530A-133C-4D7C-8993-D5C42D79A0B5", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*", "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*", "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*", "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be written but proceed as though the copy operation had succeeded. This means that the data to be written is instead replaced with whatever data had been in the packet buffer previously. Thus, an unprivileged user with access to an affected system may abuse the bug to trigger disclosure of sensitive information. In particular, the leak is limited to data previously stored in mbufs, which are used for network transmission and reception, and for certain types of inter-process communication.\n\nThe bug can also be triggered unintentionally by system applications, in which case the data written by the application to an NFS mount may be corrupted. Corrupted data is written over the network to the NFS server, and thus also susceptible to being snooped by other hosts on the network.\n\nNote that the bug exists only in the NFS client; the version and implementation of the server has no effect on whether a given system is affected by the problem."}, {"lang": "es", "value": "Cuando un programa que se ejecuta en un sistema afectado agrega datos a un archivo a trav\u00e9s de un montaje de NFS client, el error puede provocar que el NFS client no pueda copiar los datos que se van a escribir, pero proceda como si la operaci\u00f3n de copia se hubiera realizado correctamente. Esto significa que los datos que se van a escribir se reemplazan con cualquier dato que haya estado previamente en el b\u00fafer de paquetes. Por lo tanto, un usuario sin privilegios con acceso a un sistema afectado puede abusar del error para provocar la divulgaci\u00f3n de informaci\u00f3n confidencial. En particular, la filtraci\u00f3n se limita a datos previamente almacenados en mbufs, que se utilizan para la transmisi\u00f3n y recepci\u00f3n de la red, y para ciertos tipos de comunicaci\u00f3n entre procesos. El error tambi\u00e9n puede ser provocado involuntariamente por aplicaciones del sistema, en cuyo caso los datos escritos por la aplicaci\u00f3n en un montaje NFS pueden estar da\u00f1ados. Los datos corruptos se escriben a trav\u00e9s de la red en el servidor NFS y, por lo tanto, tambi\u00e9n son susceptibles de ser espiados por otros hosts de la red. Tenga en cuenta que el error existe s\u00f3lo en el NFS client; la versi\u00f3n y la implementaci\u00f3n del servidor no tienen ning\u00fan efecto sobre si un sistema determinado se ve afectado por el problema."}], "id": "CVE-2023-6660", "lastModified": "2024-11-21T08:44:18.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-12-13T09:15:34.730", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-23:18.nfsclient.asc"}, {"source": "[email protected]", "url": "https://security.netapp.com/advisory/ntap-20240322-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-23:18.nfsclient.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240322-0002/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}]}

{}