Technical impact
A flaw in the FreeBSD kernel allows an unprivileged local user to obtain uninitialized kernel stack memory. When an application creates a POSIX timer using CLOCK_TAI and calls timer_settime(2), the kernel converts the request with realtimer_gettime(). If no TAI offset is configured, the conversion can fail, but the code does not check the error status. Consequently, an uninitialized output buffer is copied to user space, exposing raw kernel stack contents.
Affected Systems
The vulnerability affects all releases of the FreeBSD operating system. No specific version ranges are listed, so any current or supported FreeBSD build that has not been updated with the vendor's fix is potentially impacted.
Risk and Exploitability
The CVSS score of 5.5 indicates a medium severity. The EPSS score remains below 1% and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a local, unprivileged user who creates a POSIX timer using CLOCK_TAI; no remote or network access is necessary. An attacker could read arbitrary kernel memory and potentially obtain information that might aid further privilege escalation (inferred), but no direct remote code execution path is present.
