CVE-2004-0126 Privilege escalation in n/a

Medium 4.6 Published 1 Sep 2004 Updated 8 Aug 2024

Local attackers can bypass jail restrictions to read or modify files in other jails via the jail_attach system call.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2004-0126?

CVE-2004-0126 is a medium-severity vulnerability in Freebsd Freebsd, published on 1 Sep 2004. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The jail_attach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesn't have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail.

Which versions are affected by CVE-2004-0126?

It affects 1 product.

Products include Freebsd Freebsd.

How do I fix CVE-2004-0126?

No fix has been published for CVE-2004-0126 yet. Limit exposure of the affected software until one is available.

Is CVE-2004-0126 being exploited?

There is no known exploitation of CVE-2004-0126 in the wild and no public exploit code.

All Freebsd Freebsd vulnerabilities

Sources

Also known as GHSA-m87g-q8c5-j57m.