CVE-2025-0374: Unprivileged access to system files

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-30 · updated 2026-06-17
Weakness: CWE-732

Description

When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally have restricted visibility, such as /etc/master.passwd. An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.

Affected products

FreeBSD: from 14.2-RELEASE before p1; from 14.1-RELEASE before p7; from 13.4-RELEASE before p3 — fixed in p1, p3, p7

How to fix

Upgrade to a fixed version: FreeBSD p1, p3, p7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-0374 or the next vulnerability affects your stack