TI-2025-00305 Aliases CVE-2025-0373 GHSA-4j4g-v3h3-8mqg

Buffer overflow in some filesystems via NFS

LOW 27CWE-121Published 2025-01-30 · Updated 2025-02-07

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow. A NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic by mounting and accessing the export with an NFS client. Further exploitation (e.g., bypassing file permission checking or remote kernel code execution) is potentially possible, though this has not been demonstrated. In particular, release kernels are compiled with stack protection enabled, and some instances of the overflow are caught by this mechanism, causing a panic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00445 38th percentileScored 2026-11-07

Fix Fixed FreeBSD (FreeBSD): p1, p7, p3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FreeBSD	FreeBSD	14.2-RELEASE to before p1; 14.1-RELEASE to before p7; 13.4-RELEASE to before p3	p1, p7, p3	Patch available	CNA

FreeBSD VendorFreeBSD Affected 14.2-RELEASE to before p1; 14.1-RELEASE to before p7; 13.4-RELEASE to before p3 Fixed in p1, p7, p3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:freebsd:freebsd::::::::	—	—	FreeBSD

cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions — — ·FreeBSD

Remediation

Fix · CNA FreeBSD (FreeBSD) Fixed in p1, p7, p3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-01-30
FreeBSD p1, p3, p7
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-00306 Unprivileged access to system filesPriority LOW 31
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-0373
2026-10-03 Alias added: GHSA-4j4g-v3h3-8mqg

References

Advisory 1

https://security.freebsd.org/advisories/FreeBSD-SA-25:02.fs.asc

TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0

See all 611 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences