CVE-2013-2171

La función vm_map_lookup en sys/vm/vm_map.c en la ejecución de "mmap" en el kernel en FreeBSD v9.0 hasta v9.1-RELEASE-p4 no determina correctamente si una tarea debe tener acceso de escritura a una posición de memoria, que permite a los usuarios locales saltarse permisos de escritura del sistema de archivos y por lo tanto obtener privilegios a través de una aplicación manipulada que aprovecha permisos de lectura, y que hace llamadas al sistema "mmap" y "ptrace".

Due to insufficient permission checks in the virtual memory system, a tracing process (such as a debugger) may be able to modify portions of the traced process's address space to which the traced process itself does not have write access. This error can be exploited to allow unauthorized modification of an arbitrary file to which the attacker has read access, but not write access. Depending on the file and the nature of the modifications, this can result in privilege escalation. To exploit this vulnerability, an attacker must be able to run arbitrary code with user privileges on the target system.