CVE-2022-23084 is a kernel memory corruption vulnerability affecting FreeBSD systems configured with netmap in their devfs_ruleset. The flaw stems from a time-of-check to time-of-use (TOCTOU) error in the nmreq_copyin() function, where the size of user-provided data is trusted after initial computation, leading to potential memory corruption. This vulnerability has a CVSS score of 7.5 (High), indicating that a privileged process within a jail could impact the host environment with high confidentiality, integrity, and availability impacts, albeit with high attack complexity. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.0, < 12.3CPE matchmatch criteria | cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* | ||
12.3CPE matchmatch criteria | cpe:2.3:o:freebsd:freebsd:12.3:-:*:*:*:*:*:* | ||
12.3CPE matchmatch criteria | cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:* | ||
12.3CPE matchmatch criteria | cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:* | ||
12.3CPE matchmatch criteria | cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.