CVE-2022-23086: mpr/mps/mpt driver ioctl heap out-of-bounds write

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-15 · updated 2026-06-17
Weakness: CWE-787

Description

Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.

Affected products

FreeBSD: from 12.0 before 12.3; 12.3, 12.3-p1, 12.3-p2, 12.3-p3, 12.3-p4, 13.0 (+21) — fixed in 12.3

How to fix

Upgrade to a fixed version: FreeBSD 12.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23086 or the next vulnerability affects your stack