Description
FreeBSD port programs that use libkvm for FreeBSD 4.6.2-RELEASE and earlier, including (1) asmon, (2) ascpu, (3) bubblemon, (4) wmmon, and (5) wmnet2, leave open file descriptors for /dev/mem and /dev/kmem, which allows local users to read kernel memory.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 4
- BubbleMon 1.x Kernel - Memory File Descriptor Leakage EDB-21796 · local · Sep 16, 2002 · verified
- ASCPU 0.60 Kernel - Memory File Descriptor Leakage EDB-21797 · local · Sep 16, 2002 · verified
- WMMon 1.0 b2 - Memory Character File Open File Descriptor Read EDB-21798 · local · Sep 16, 2002 · verified
- WMNet2 1.0 6 - Kernel Memory File Descriptor Leakage EDB-21799 · local · Sep 16, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20020916 iDEFENSE Security Advisory 09.16.2002: FreeBSD Ports libkvm Security Vulnerabilities mailing-list
- 5719 vdb-entry
- 5718 vdb-entry
- 5714 vdb-entry
- bsd-libkvm-descriptor-leak(10109) vdb-entry
- 5720 vdb-entry
- 20020916 iDEFENSE Security Advisory 09.16.2002: FreeBSD Ports libkvm Security Vulnerabilities mailing-list
- 5716 vdb-entry