CVE-2023-5978: Incorrect libcap_net limitation list manipulation

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-08 · updated 2026-06-17
Weakness: CWE-269

Description

In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. When only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. This could permit the application to resolve domain names that were previously restricted.

Affected products

FreeBSD: from 13.0 before 13.2; 13.2, 13.2-p1, 13.2-p2, 13.2-p3, 13.2-p4 — fixed in 13.2

How to fix

Upgrade to a fixed version: FreeBSD 13.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5978 or the next vulnerability affects your stack