CVE-2023-5368

Summary

CVE	CVE-2023-5368
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-10-04 04:15:00 UTC
Updated	2023-10-05 17:08:00 UTC
Description	On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes. This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).

Risk And Classification

Problem Types: CWE-1188

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Freebsd	Freebsd	All	All	All	All
Operating System	Freebsd	Freebsd	12.4	-	All	All
Operating System	Freebsd	Freebsd	12.4	p1	All	All
Operating System	Freebsd	Freebsd	12.4	p2	All	All
Operating System	Freebsd	Freebsd	12.4	p3	All	All
Operating System	Freebsd	Freebsd	12.4	p4	All	All
Operating System	Freebsd	Freebsd	12.4	p5	All	All
Operating System	Freebsd	Freebsd	13.2	-	All	All
Operating System	Freebsd	Freebsd	13.2	p1	All	All
Operating System	Freebsd	Freebsd	13.2	p2	All	All
Operating System	Freebsd	Freebsd	13.2	p3	All	All

References

Reference	Source	Link	Tags
security.FreeBSD.org/advisories/FreeBSD-SA-23:12.msdosfs.asc	MISC	security.FreeBSD.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

691315 Free Berkeley Software Distribution (FreeBSD) Security Update for Free Berkeley Software Distribution (FreeBSD) (fefcd340-624f-11ee-8e38-002590c1f29c)