CVE intelligence and bounded remediation

CVE-2023-6660 — Freebsd Freebsd security vulnerability

Medium CVSS 6.5

When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be written but proceed as though the copy operation had succeeded. This means that the data to be written is instead replaced with whatever data had been in the packet buffer previously. Thus, an unprivileged user with access to an affected system may abuse the bug to trigger disclosure of sensitive information. In particular, the leak is limited to data previously stored in mbufs, which are used for network transmission and reception, and for certain types of inter-process communication. The bug can also be triggered unintentionally by system applications, in which case the data written by the application to an NFS mount may be corrupted. Corrupted data is written over the network to the NFS server, and thus also susceptible to being snooped by other hosts on the network. Note that the bug exists only in the NFS client; the version and implementation of the server has no effect on whether a given system is affected by the problem.

Severity
Medium
CVSS
6.5 (3.1)
Published
2023-12-13
CISA KEV
Not currently listed
Ecosystem
operating-system

Affected products

  • freebsd / freebsd / 13.2
  • freebsd / freebsd / 14.0

Showing 2 representative product identities from 14 source matches. Confirm exact affected versions with the linked vendor and NVD evidence.

Matched remediation archetype

Information disclosure and sensitive data exposure

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Trace sensitive data through responses, errors, logs, metrics, traces, caches, exports, files, backups, and client bundles.
  • Identify affected subjects, tenants, retention windows, access controls, and downstream copies without opening unnecessary sensitive records.
  • Review metadata, timing, status, length, and existence signals as well as direct content disclosure.

Remediate safely

  • Minimize collection and output, apply field-level authorization and redaction at a centralized boundary, and return generic external errors.
  • Remove secrets and sensitive data from logs, artifacts, URLs, caches, and client-side bundles; rotate credentials that may have been exposed.
  • Update the affected component and add synthetic-data tests for response, error, observability, and export paths.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.