FreeBSD vulnerabilities

In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, allowing processes in one jail to read and modify the content of POSIX shared memory objects created by processes in another jail or the host system.

FreeBSD versions 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.

Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10, 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

Vulnerability in FreeBSD's kern_jail_set() and kern_jail_get() when the JAIL_AT_DESC flag is used. Double release of the caller's current prison reference can lead to a reference count underflow and use-after-free.

Vulnerability in FreeBSD kernel when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object. Physical pages are marked invalid but remain in the pager's list, leading to a double free on object destruction.

Vulnerability in FreeBSD during execve(2) of SUID binaries. The new virtual address space is installed before credentials are updated, allowing another process of the same user to access memory via procfs or linprocfs.

A vulnerability in the sigqueue(2) implementation in FreeBSD allows a process in capability mode to send signals to any process, bypassing Capsicum sandbox restrictions. The missing check for the target PID being the calling process's own enables an attacker to interfere with other processes.

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.

The mount_union command in FreeBSD allows local users to gain root privileges via a symlink attack.

CVE-1999-0052 concerns IP fragmentation in FreeBSD that can lead to system crashes. A remote attacker can exploit this vulnerability to cause unexpected system downtime.

CVE-1999-0053 is a denial of service (DoS) vulnerability in FreeBSD that exploits TCP RST packets. An attacker can remotely initiate a connection reset, leading to service disruption.

FreeBSD allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system.

The mmap function in FreeBSD allows users to modify append-only or immutable files.

The open() function in FreeBSD allows local attackers to write to arbitrary files.