Read the docs
TI-2022-07255 Aliases CVE-2022-23086GHSA-8xxh-r5gq-2wxg

mpr/mps/mpt driver ioctl heap out-of-bounds write

Priority MEDIUM 49CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00447 39th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p1, p11, p5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeBSDFreeBSD13.1-RC1 to before p1; 13.0-RELEASE to before p11; 12.3-RELEASE to before p5p1, p11, p5Patch availableCNA
  • FreeBSD VendorFreeBSD Affected 13.1-RC1 to before p1; 13.0-RELEASE to before p11; 12.3-RELEASE to before p5 Fixed in p1, p11, p5 Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*12.0 to before 12.3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:12.3:-:*:*:*:*:*:*12.3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:*12.3 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:*12.3 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:*12.3 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:*12.3 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:-:*:*:*:*:*:*13.0VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:*13.0 beta1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:*13.0 beta2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:*13.0 beta3VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions 12.0 to before 12.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:12.3:-:*:*:*:*:*:* Versions 12.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:* Versions 12.3 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:* Versions 12.3 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:* Versions 12.3 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:* Versions 12.3 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:-:*:*:*:*:*:* Versions 13.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:* Versions 13.0 beta1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:* Versions 13.0 beta2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:* Versions 13.0 beta3 Vulnerable ·FreeBSD
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:*13.0 beta3-p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:*13.0 beta4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:*13.0 p1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:*13.0 p10VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:*13.0 p2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:*13.0 p3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:*13.0 p4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:*13.0 p5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:*13.0 p6VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:*13.0 p7VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:*13.0 p8VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:*13.0 p9VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:*13.0 rc1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:*13.0 rc2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:*13.0 rc3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:*13.0 rc4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:*13.0 rc5VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:*13.0 rc5-p1VulnerableFreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:* Versions 13.0 beta3-p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:* Versions 13.0 beta4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:* Versions 13.0 p1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:* Versions 13.0 p10 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:* Versions 13.0 p2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:* Versions 13.0 p3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:* Versions 13.0 p4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:* Versions 13.0 p5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:* Versions 13.0 p6 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:* Versions 13.0 p7 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:* Versions 13.0 p8 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:* Versions 13.0 p9 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:* Versions 13.0 rc1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:* Versions 13.0 rc2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:* Versions 13.0 rc3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:* Versions 13.0 rc4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:* Versions 13.0 rc5 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:* Versions 13.0 rc5-p1 Vulnerable ·FreeBSD

Remediation

  • Fix · CNA FreeBSD (FreeBSD) Fixed in p1, p11, p5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FreeBSD p1, p11, p5

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-07257 802.11 heap buffer overflowPriority MEDIUM 55
    • TI-2022-07256 Bhyve e82545 device emulation out-of-bounds writePriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23086
  2. 2026-10-03 Alias added: GHSA-8xxh-r5gq-2wxg

References

Advisory 2

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
See all 576 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences