evolve or die

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

FreeBSD 7.0 - 7.2 pseudofs NULL Pointer Dereference

Posted Sep 9, 2010

Authored by Przemyslaw Frasunek

FreeBSD versions 7.0 through 7.2 suffer from a pseudofs NULL pointer dereference vulnerability. Due to a spurious call to pfs_unlock() in pfs_getattr() (as defined in sys/fs/pseudofs/pseudofs_vnops.c), a null pointer is dereferenced after calling extattr_get_attribute() on pseudofs vnode. By allocating a page at address 0x0, an attacker can overwrite an arbitrarily chosen portion of kernel memory, leading to a crash or local root escalation.

tags | advisory, kernel, local, root

systems | freebsd

MD5 | ae95fee8dbe809a26ee1bc0179eb8bf6

Download | Favorite | Comments (0)