FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- GELI silently omits the keyfile if read from stdin

Affected packages
13.1 <= FreeBSD-kernel < 13.1_6
12.4 <= FreeBSD-kernel < 12.4_1
12.3 <= FreeBSD-kernel < 12.3_11

Details

VuXML ID 3fcab88b-47bc-11ee-8e38-002590c1f29c
Discovery 2023-02-08
Entry 2023-08-31

Problem Description:

When GELI reads a key file from a standard input, it doesn't store it anywhere. If the user tries to initialize multiple providers at once, for the second and subsequent devices the standard input stream will be already empty. In this case, GELI silently uses a NULL key as the user key file. If the user used only a key file without a user passphrase, the master key was encrypted with an empty key file. This might not be noticed if the devices were also decrypted in a batch operation.

Impact:

Some GELI providers might be silently encrypted with a NULL key file.

References

CVE Name CVE-2023-0751
FreeBSD Advisory SA-23:01.geli