CVE-2018-17154

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-28 · updated 2026-06-17
Weakness: CWE-476

Description

In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstat system call, a NULL pointer dereference can occur. Unprivileged authenticated local users may be able to cause a denial of service.

Affected products

FreeBSD: before 11.2; 11.1-p15, 11.2-p4 — fixed in 11.2

How to fix

Upgrade to a fixed version: FreeBSD 11.2. Check the vendor advisory for mitigations.

References

https://security.FreeBSD.org/advisories/FreeBSD-EN-18:10.syscall.asc
https://security.FreeBSD.org/advisories/FreeBSD-EN-18:10.syscall.asc

Get alerted when CVE-2018-17154 or the next vulnerability affects your stack