Attacker Value
Very High
(1 user assessed)
Exploitability
Very Low
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2019-5596

Disclosure Date: February 12, 2019
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.

Add Assessment

1
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Very Low
Technical Analysis

Exploitation of this vulnerability is temperamental at least, destructive at most. While triggering the exploit, it seems somewhat dependent on a higher than default kern.maxfiles. If maxfiles is set too low, the box will reboot.
If exploitation is successful, in order to cause the RCE, /etc/libmap.confis altered. If the original one is not restored, the box is bricked since it attempts to call the payload which was most likely deleted once run.
Exploitation can take between 20-70 minutes.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
6
Exploitability Score:
2
Vector:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • freebsd

Products

  • freebsd 11.2,
  • freebsd 12.0

Additional Info

Technical Analysis