CVE-2014-8612

Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.6 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
VendorProductVersion
freebsdfreebsd
8.4
freebsdfreebsd
9.3
freebsdfreebsd
10.0
freebsdfreebsd
10.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
kfreebsd-8
utopic
dne
trusty
dne
precise
dne
lucid
ignored
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2015/Jan/107
http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities
http://www.securityfocus.com/archive/1/534563/100/0/threaded
http://www.securityfocus.com/bid/72342
http://www.securitytracker.com/id/1031648
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc
http://seclists.org/fulldisclosure/2015/Jan/107
http://www.coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities
http://www.securityfocus.com/archive/1/534563/100/0/threaded
http://www.securityfocus.com/bid/72342
http://www.securitytracker.com/id/1031648
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc