Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2023-0751

GELI silently omits the keyfile if read from stdin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unaffected

  • 13.1-RELEASE to < 13.1-RELEASE-p6affected
  • 12.4-RELEASE to < 12.4-RELEASE-p1affected
  • 12.3-RELEASE to < 12.3-RELEASE-p11affected

References