Published: 06/10/2009 Updated: 07/10/2009

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 695

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or memory corruption.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd 6.3
freebsd freebsd 6.4

#if 0 FreeBSD 64 and below are vulnerable to race condition between pipeclose() and knlist_cleardel() resulting in NULL pointer dereference The following code exploits vulnerability to run code in kernel mode, giving root shell and escaping from jail #endif /* 29082009, babcia padlina * FreeBSD <= 64 pipeclose()/knlist_cleardel() race co ...

CWE-362 http://osvdb.org/58544 http://www.securityfocus.com/archive/1/506449 http://www.securitytracker.com/id?1022982 http://security.freebsd.org/advisories/FreeBSD-SA-09:13.pipe.asc http://www.securityfocus.com/bid/36375 https://nvd.nist.gov https://www.exploit-db.com/exploits/9859/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-3527

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect