CVE-2008-3531

FreeBSD 7.0-7.1 - Local Privilege Escalation via Stack-Based Buffer Overflow in vfs_mount.c

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2008-3531. PoCs published by Patroklos Argyroudis, test-one9.

AI-analyzed exploit summary This exploit leverages a buffer overflow in FreeBSD's nmount system call (CVE-2008-3531) to achieve local privilege escalation by overwriting kernel memory with shellcode that modifies the current process's credentials to root.

Description

Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain privileges via a crafted (1) mount or (2) nmount system call, related to copying of "user defined data" in "certain error conditions."

Exploits (2)

exploitdb WORKING POC VERIFIED
by Patroklos Argyroudis · clocalfreebsd
https://www.exploit-db.com/exploits/9082

This exploit leverages a buffer overflow in FreeBSD's nmount system call (CVE-2008-3531) to achieve local privilege escalation by overwriting kernel memory with shellcode that modifies the current process's credentials to root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: FreeBSD 7.0-RELEASE (with vfs.usermount enabled)
No auth needed
Prerequisites: FreeBSD 7.0-RELEASE with vfs.usermount enabled · Local user access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by test-one9 · poc
https://github.com/test-one9/ps4-11.50.github.io

The repository contains only a minimal README with no exploit code or technical details. It references CVE-2008-3531 but provides no functional PoC or analysis.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31002
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020816
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45143
Various Sources vendor-advisory x_refsource_freebsd
http://security.FreeBSD.org/advisories/FreeBSD-SA-08:08.nmount.asc

Scores

EPSS 0.0103
EPSS Percentile 59.2%

Details

CWE
CWE-119
Status published
Products (2)
freebsd/freebsd 7.0
freebsd/freebsd 7.1
Published Sep 05, 2008
Tracked Since Feb 18, 2026