Vulnerability · Published Feb 8, 2023 · Assigned by freebsd

CVE-2023-0751GELI silently omits the keyfile if read from stdin

Medium 6.5

In plain English

A medium-severity improper input validation in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	13.1-RELEASE – before 13.1-RELEASE-p612.4-RELEASE – before 12.4-RELEASE-p112.3-RELEASE – before 12.3-RELEASE-p11

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References