CVE-2013-2171

CVE-2013-2171 affects FreeBSD 9.0–9.1-RELEASE-p4 where vm_map_lookup in the mmap path may bypass write-permissions checks, enabling local privilege escalation via crafted mmap/ptrace usage. Exploitation details appear in public modules (Metasploit, CANVAS) and vendor advisories describe the fix i...

FreeBSD Security Advisory FreeBSD-SA-13:06.mmap [REVISED]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic: Privilege escalation via mmap Category: core Module: kernel Announced: 2013-06-18 Credits: Konstantin...

FreeBSD mmap+ptrace vulnerability

It's possible to modify mmap memory mapped files via ptrace...

Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... :)

$ uname -a FreeBSD fbsd91x64 9.1-RELEASE FreeBSD 9.1-RELEASE 0 r243825: Tue Dec 4 09:23:10 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64 $ id uid=1001hunger gid=1002hunger groups=1002hunger $ gcc fbsd9lul.c -o fbsd9lul $ ./fbsd9lul FreeBSD 9.0,1 mmap/ptrace exploit by...

FreeBSD 9.0+ Privilege Escalation

/ CVE-2013-2171 FreeBSD 9.0+ Privilege escalation via mmap poc by SynQ, rdot.org, 6/2013 don't forget to cp /etc/crontab /tmp / include include include include include include include include char sc="\t\t\t\t\troot\t/tmp/bukeke\n"; void child int status; status = ptracePTTRACEME, 0, 0, 0; if...

FreeBSD 9.0 < 9.1 - 'mmap/ptrace' Local Privilege Escalation

/ FreeBSD 9.0,1 mmap/ptrace exploit by Hunger Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... : Greetings to nohup, 2501, boldi, eax, johnnyb, kocka, op, pipacs, prof, sd, sghctoma, snq, spender, s2crew and others at hekkcamp: I hope we'll meet...

FreeBSD mmap Privilege Escalation Exploit

This exploits performs privilege escalation leveraging the mmap vulnerability in FreeBSD 9.1 as described in FreeBSD-SA-13:06. / FreeBSD privilege escalation CVE-2013-2171 credits Konstantin Belousov & Alan Cox tested on FreeBSD 9.1 ref:...

FreeBSD : FreeBSD -- Privilege escalation via mmap (abef280d-d829-11e2-b71c-8c705af55518)

Due to insufficient permission checks in the virtual memory system, a tracing process such as a debugger may be able to modify portions of the traced process's address space to which the traced process itself does not have write access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD-SA-13:06.mmap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic: Privilege escalation via mmap Category: core Module: kernel Announced: 2013-06-18 Credits: Konstantin...

FreeBSD -- Privilege escalation via mmap

Due to insufficient permission checks in the virtual memory system, a tracing process such as a debugger may be able to modify portions of the traced process's address space to which the traced process itself does not have write access...

Qualcomm Gandalf camera driver

The camera driver provides several interfaces to user space clients. The user space clients communicate to the kernel via syscalls such as ioctl or mmap. The camera driver provides an uncontrolled mmap interface that allows an application with access to the device file to map physical memory...

MongoDB - nativeHelper.apply Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'MongoDB nativeHelper.apply Remote Cod...

Linux Kernel 3.7.10 (Ubuntu 12.10 x64) - sock_diag_handlers Local Privilege Escalation (2)

Linux Kernel 3.7.10 Ubuntu 12.10 x64 - sockdiaghandlers Local Privilege Escalation 2 include include include include include include include include include include include include include include typedef int attributeregparm3 commitcredsunsigned long cred; typedef unsigned long attributeregparm3...

Code injection

The Linux kernel before 2.6.39 does not properly create transparent huge pages in response to a MAPPRIVATE mmap system call on /dev/zero, which allows local users to cause a denial of service system crash via a crafted application...

USN-1609-1: Linux kernel (OMAP4) vulnerability

A flaw was found in how the Linux kernel's KVM Kernel-based Virtual Machine subsystem handled MSI Message Signaled Interrupts. A local unprivileged user could exploit this flaw to cause a denial of service or potentially elevate privileges. CVE-2012-2137 Mathias Krause discover an error in Linux...

kernel: huge pages: memory leak on mmap failure

Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service memory consumption or system crash via invalid MAPHUGETLB mmap operations...

CVE-2012-4754

Multiple untrusted search path vulnerabilities in MindManager 2012 10.0.493 allow local users to gain privileges via a Trojan horse 1 ssgp.dll or 2 dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .mmap file. NOTE: some of these details are obtained...

kernel: huge pages: memory leak on mmap failure

Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service memory consumption or system crash via invalid MAPHUGETLB mmap operations...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

These updated packages fix the following security issue : - a possible kernel memory leak was found in the Linux kernel Simple Internet Transition SIT INET6 implementation. This could allow a local unprivileged user to cause a denial of service. CVE-2008-2136, Important As well, these updated...

Linux Kernel Sendpage Local Privilege Escalation

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...