The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and previous versions, NetBSD 1.3 and previous versions, and OpenBSD 2.6 and previous versions, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
openbsd openbsd |
||
freebsd freebsd |
||
netbsd netbsd |