FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

Bugtraq ID:	100349
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 16 2017 12:00AM
Updated:	Aug 16 2017 12:00AM
Credit:	WhiteWinterWolf
Vulnerable:	FreeBSD FreeBSD 9.3 FreeBSD FreeBSD 9.2 FreeBSD FreeBSD 9.1 FreeBSD FreeBSD 9.0 FreeBSD FreeBSD 8.4 FreeBSD FreeBSD 8.3 FreeBSD FreeBSD 8.2 FreeBSD FreeBSD 8.1 FreeBSD FreeBSD 8.0 FreeBSD FreeBSD 7.4 FreeBSD FreeBSD 7.3 FreeBSD FreeBSD 7.2 FreeBSD FreeBSD 7.1 FreeBSD FreeBSD 7.0 FreeBSD Freebsd 10.3 FreeBSD Freebsd 10.2 FreeBSD FreeBSD 10.1 FreeBSD Freebsd 10.0
Not Vulnerable:	FreeBSD Freebsd 11.0

FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

FreeBSD is prone to a local security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks.

FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

References:

• FreeBSD <= 10.3 jail SHM hole (WhiteWinterWolf)
  
• FreeBSD Homepage (FreeBSD)