MNBSD-2014-17: Kernel memory disclosure via getlogin/setlogin

Description

getlogin(2) could leak kernel memory via a buffer that is copied to userland without being cleared. A local user could read uninitialized kernel stack memory, potentially exposing sensitive information.

Affected Versions

kernel

Recommendations

No specific recommendations provided.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-14:25.setlogin.asc
• https://www.cve.org/CVERecord?id=CVE-2014-8476

Additional Information

Aliases: CVE-2014-8476

Published: November 06, 2014
Last Modified: November 06, 2014