FreeBSD 7.0-7.2 - Local Arbitrary Kernel Memory Overwrite via ktimer Out-of-Bounds Timer Value
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel memory via an out-of-bounds timer value.