58 matches found
CVE-2016-6242: Undefined Security Weakness
OpenBSD 5.8 and 5.9 allows local users to cause a denial of service assertion failure and kernel panic via a large ident value in a kevent system call...
FreeBSD <= 6.1 kqueue() NULL pointer Dereference Local Root Exploit
No description provided by source. / FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread...
BSD systems kevent race conditions
Race conditions on SMP systems...
FreeBSD kevent()系统调用竞争条件漏洞
BUGTRAQ ID: 36101 FreeBSD就是一种运行在Intel平台上、可以自由使用的开放源码Unix类系统。 FreeBSD的SMP系统中的kevent系统调用存在竞争条件错误。如果本地用户生成了两个线程，其中第一个线程循环执行open和close系统调用而第二个线程循环执行kevent尝试添加无效的文件描述符，就会触发内核态的空指针引用，导致拒绝服务或运行root shell。 FreeBSD = 6.1 厂商补丁： FreeBSD ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
FreeBSD <= 6.1 kqueue() NULL pointer Dereference Local Root Exploit
No description provided by source. FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread loopin...
FreeBSD 6.1 - 'kqueue()' Null Pointer Dereference Privilege Escalation
/ FreeBSD include include include include include include include include include include include include int fd, kq; struct kevent kev, ke; struct timespec timeout; volatile int gotroot = 0; static void kernelcodevoid struct thread thread; gotroot = 1; asm "movl %%fs:0, %0" : "=r"thread ;...
FreeBSD 6.1 - kqueue() Null Pointer Dereference Privilege Escalation
FreeBSD 6.1 - kqueue Null Pointer Dereference Privilege Escalation / FreeBSD include include include include include include include include include include include include int fd, kq; struct kevent kev, ke; struct timespec timeout; volatile int gotroot = 0; static void kernelcodevoid struct thre...
FreeBSD <= 6.1 kqueue() NULL pointer dereference
FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread looping on kevent, trying to add possibly...
FreeBSD <= 6.1 kqueue() NULL pointer Dereference Local Root Exploit
Exploit for freebsd platform in category local exploits =================================================================== FreeBSD include include include include include include include include include include include include int fd, kq; struct kevent kev, ke; struct timespec timeout; volatile...
FreeBSD <= 6.1 kqueue() NULL pointer dereference
FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread looping on kevent, trying to add possibly...
Buffer overflow
The nvcoaft51 driver in Norman Virus Control NVC 5.82 uses weak permissions unrestricted write access for the NvcOa device, which allows local users to gain privileges by 1 triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by 2 sending a crafted KEVENT...
norton-local.txt
/ Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can be opened by any user. As result, a user can send a...
Norman Virus Control - nvcoaft51.sys ioctl BF672028
Norman Virus Control - nvcoaft51.sys ioctl BF672028 / Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can b...
Norman Virus Control - 'nvcoaft51.sys' ioctl BF672028
/ Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can be opened by any user. As result, a user can send a...
Norman Virus Control nvcoaft51.sys ioctl BF672028 Exploit
Exploit for unknown platform in category local exploits ========================================================= Norman Virus Control nvcoaft51.sys ioctl BF672028 Exploit ========================================================= / Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstrac...
CVE-2006-6127
Apple Mac OS X kernel allows local users to cause a denial of service via a process that uses kevent to register a queue and an event, then fork a child process that uses kevent to register an event for the same queue as the parent...
CVE-2006-6127
This CVE concerns Apple macOS X kernel: a vulnerability in the kevent-based queue registration flow that can be triggered locally. A process registers a kevent queue and an event, then forks a child that also registers an event for the same queue as the parent, enabling a local attacker to cause ...
CVE-2006-6127: Undefined Security Weakness
Apple Mac OS X kernel allows local users to cause a denial of service via a process that uses kevent to register a queue and an event, then fork a child process that uses kevent to register an event for the same queue as the parent...