Description
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | kfreebsd-9 | 9.0-10+deb70.2 | DSA-2714-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
FreeBSD 9 Address Space Manipulation Privilege Escalation
exploit/freebsd/local/mmap
Exploit-DB 2
- FreeBSD 9 - Address Space Manipulation Privilege Escalation (Metasploit) EDB-26454 · local · Jun 26, 2013 · verified
- FreeBSD 9.0 < 9.1 - 'mmap/ptrace' Local Privilege Escalation EDB-26368 · local · Jun 21, 2013 · verified
GitHub 1 repository
-
0xGabe/FreeBSD-9.0-9.1-Privilege-Escalation ★ 1 · Nov 18, 2021
CVE-2013-2171
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2714-1 kfreebsd-9 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- FreeBSD-SA-13:06 vendor-advisory
- DSA-2714 vendor-advisory
- http://svnweb.freebsd.org/base?view=revision&revision=251901