Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD…

Description

Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.

Scores

EPSS (exploitation in 30 days)

0.42% · top 63% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (19)

• 20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1017344 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• [tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FreeBSD-SA-06:25 (opens in a new tab)vendor-advisoryx_refsource_FREEBSDx_transferred
• freebsd-fwdev-integer-overflow(30347) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20061121 Clarifying integer overflows vs. signedness errors (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20061122 Re: Clarifying integer overflows vs. signedness errors (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• [tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c (opens in a new tab)x_refsource_MISCx_transferred
• 21089 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 22917 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www.kernelhacking.com/bsdadv1.txt (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-6013](https://trackcve.app/badge/CVE-2006-6013.svg)](https://trackcve.app/cve/CVE-2006-6013)

Record last updated 7 Aug 2024, 20:12 UTC.