CVE-2019-15876

In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
freebsdCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
VendorProductVersion
freebsdfreebsd
11.3
freebsdfreebsd
11.3:p1
freebsdfreebsd
11.3:p2
freebsdfreebsd
11.3:p3
freebsdfreebsd
11.3:p4
freebsdfreebsd
11.3:p5
freebsdfreebsd
11.3:p6
freebsdfreebsd
12.1
freebsdfreebsd
12.1:p1
freebsdfreebsd
12.1:p2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc