4.6

CVE-2014-8612

Exploit

EPSS 0.36%
Published 02.02.2015 16:59:01
Last modified 12.04.2025 10:46:40
Source cve@mitre.org
Teams watchlist Login
Open Login

Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.

Affected products Warnungen 0 Metrics 2 CWE 0 References 9

Data is provided by the National Vulnerability Database (NVD)

Freebsd ≫ Freebsd Version8.4

Freebsd ≫ Freebsd Version9.3

Freebsd ≫ Freebsd Version10.0

Freebsd ≫ Freebsd Version10.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.36%	0.552

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

http://seclists.org/fulldisclosure/2015/Jan/107

Exploit

http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities

Exploit

http://www.securityfocus.com/archive/1/534563/100/0/threaded

http://www.securityfocus.com/bid/72342

http://www.securitytracker.com/id/1031648

Exploit

https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-8612

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-8612

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-8612

EUVD