Locally exploitable races in OpenBSD VFS

my apologies if it ends up submitted twice Let's start with the trivial: good old aliasing bugs. Example 1: dup2 vs. close. Relevant file: kern/kerndescrip.c sysdup2p, v, retval struct proc p; void v; registert retval; snip if uintold = fdp-fdnfiles || fdp-fdofilesold == NULL || uintnew =...

CVE-2001-1047

Race condition in OpenBSD VFS allows local users to cause a denial of service kernel panic by 1 creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or 2 calling dup2 on a file descriptor in one process, then setting the descriptor to NU...

CVE-2001-0268

The i386setldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USERLDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table LDT with a target that...

CVE-2000-1040

CVE-2000-1040 concerns a format string vulnerability in the logging function of ypbind 3.3 when run in debug mode. The flaw can leak file descriptors and allow a denial of service. Some sources (Mandrake MDKSA-2000:064) also mention a related buffer overflow in ypserv if the build system lacks vs...

CVE-2000-0786

GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...

CVE-2000-0786

GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERVGROUPS and USERVGIDS environmental variables and allow local users to bypass some access restrictions...

CVE-2000-0786

GNU userv 1.0.0 and earlier are affected by an issue where improper file descriptor swapping can corrupt the USERV_GROUPS and USERV_GIDS environment variables, potentially allowing local users to bypass some access restrictions. The public documentation identifies the affected component and the c...

CVE-1999-0886

Technical details for CVE-1999-0886 are not publicly provided in the supplied documents. Monitor for updates. The records note a RASMAN security descriptor issue enabling an alternate location via the Windows NT Service Control Manager.

ftpd.dos.pl

Who has more free file descriptors & network ports, you or the ftp server ? ftpd's which limit connections to 1 per user@host or similar may have some defense against this, or if they don't support multiple data connections open at the same time. I suspect "many" is the number of ftpd's which are...

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service

ISC BIND 8.2.2 IRIX 6.5.17 Solaris 7.0 - NXT Overflow Denial of Service // source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records...

ISC BIND 8.2.2 / IRIX 6.5.17 / Solaris 7.0 - NXT Overflow / Denial of Service

// source: https://www.securityfocus.com/bid/788/info There are several vulnerabilities in recent BIND packages pre 8.2.2. The first is a buffer overflow condition which is a result of BIND improperly validating NXT records. The consequence of this being exploited is a remote root compromise...

CVE-1999-0062

The OpenBSD chpass command is affected by a local-privilege-escalation flaw caused by file-descriptor leakage, enabling a local user to gain root access. The provided documents do not specify affected versions, exact root-cause details, exploit steps, or available fixes. No exploitation workflow ...

CVE-1999-0083

getcwd file descriptor leak in FTP...

CVE-1999-0083

CVE-1999-0083 corresponds to a getcwd() file descriptor leak in FTP. The available connected data identifies the vulnerability as a leak in the getcwd() call within FTP, but no exploit details are provided. CVSS 2.0 metrics indicate a Network attack vector, Low attack complexity, no authenticatio...

CVE-1999-0886

The security descriptor for RASMAN allows users to point to an alternate location via the Windows NT Service Control Manager...

FreeBSD 3.0 - UNIX-domain Panic (Denial of Service)

FreeBSD 3.0 - UNIX-domain Panic Denial of Service / source: https://www.securityfocus.com/bid/168/info A vulnerability in FreeBSD's UNIX-domain protocol implementation of file descriptor passing can cause the kernel to panic. / include include include include include include define PATH "/tmp/123...

FreeBSD 3.0 - UNIX-domain Panic (Denial of Service)

/ source: https://www.securityfocus.com/bid/168/info A vulnerability in FreeBSD's UNIX-domain protocol implementation of file descriptor passing can cause the kernel to panic. / include include include include include include define PATH "/tmp/123" define PATHTMP "/tmp/123.tmp" define SOMEFILE...

CVE-1999-0062

The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage...

Solaris 2.5.1 - rsh socket Descriptor

Solaris 2.5.1 - rsh socket Descriptor // source: https://www.securityfocus.com/bid/453/info A vulnerability in rsh exists that can allow a regular user to modify a root owned socket descriptor. The consequences of this are a possible denial of service due to interfaces being manipulated by...

Solaris 2.5.1 - rsh socket Descriptor

// source: https://www.securityfocus.com/bid/453/info A vulnerability in rsh exists that can allow a regular user to modify a root owned socket descriptor. The consequences of this are a possible denial of service due to interfaces being manipulated by malicious users. cc solarisuck.c -o solarisu...