Description
procfs in FreeBSD and possibly other operating systems does not properly restrict access to per-process mem and ctl files, which allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's address space.
References
- 2130 vdb-entry
- procfs-elevate-privileges(6106) vdb-entry
- 1697 vdb-entry