Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow.

According to its self-reported version number, the remote pfSense install is prior to 2.3. It is, therefore, affected by multiple vulnerabilities.

A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. Impact : This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

ID	Name	Product	Family	Severity
106499	pfSense < 2.3 Multiple Vulnerabilities (SA-16_01 - SA-16_02)	Nessus	Firewalls	critical
92922	FreeBSD : FreeBSD -- Incorrect argument validation in sysarch(2) (7b6a11b5-600a-11e6-a6c3-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-1885

medium

Tenable Plugins

critical

medium