CVE-2013-2171 Privilege escalation in n/a

Medium 6.9 Published 2 Jul 2013 Updated 6 Aug 2024

Local attackers can bypass filesystem write permissions and gain privileges via crafted applications using mmap and ptrace in the FreeBSD kernel.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2171?

CVE-2013-2171 is a medium-severity vulnerability in Freebsd Freebsd, published on 2 Jul 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.

Weakness: CWE-264

Which versions are affected by CVE-2013-2171?

It affects 1 product.

Products include Freebsd Freebsd.

How do I fix CVE-2013-2171?

Apply the vendor's patch.

Is CVE-2013-2171 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-2171 exists.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 1 proofs of concept on GitHub.

All Freebsd Freebsd vulnerabilities

Sources

Also known as DSA-2714-1, GHSA-gmfh-rp5h-w5mv.