Home page logo
/

bugtraq logo Bugtraq mailing list archives

FreeBSD 6.4 pipeclose()/knlist_cleardel() race condition exploit
From: Przemyslaw Frasunek <venglin () freebsd lublin pl>
Date: Thu, 08 Oct 2009 16:29:05 +0200

FreeBSD 6.4 and below are vulnerable to race condition between pipeclose() and
knlist_cleardel() resulting in NULL pointer dereference. The following code
exploits vulnerability to run code in kernel mode, giving root shell and
escaping from jail.

http://www.frasunek.com/pipe.txt

The bug was fixed a week ago and official security advisory was issued:

http://security.freebsd.org/advisories/FreeBSD-SA-09:13.pipe.asc

-- 
* Fido: 2:480/124 ** WWW: http://www.frasunek.com ** NICHDL: PMF9-RIPE *
* Jabber ID: venglin () czuby pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ5JIV *


  By Date           By Thread  

Current thread:
  • FreeBSD 6.4 pipeclose()/knlist_cleardel() race condition exploit Przemyslaw Frasunek (Oct 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault