CVE-2013-2171: freebsd

Vulnerability summary

CVE-2013-2171 is a medium (CVSS 6.9) vulnerability in freebsd. EPSS estimates a 6.94% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 02-07-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.