CVE-2008-5736
FreeBSD 6-7 - Privilege Escalation via Uninitialized Function Pointers
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-5736. PoCs published by Don Bailey, zx2c4.
AI-analyzed exploit summary This exploit targets a FreeBSD kernel vulnerability (CVE-2008-4946) in the protosw structure to overwrite the credential structure, granting root privileges (euid=0) to the attacker's process. It uses memory mapping and a crafted payload to achieve local privilege escalation.
Description
Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 before 7.1-RC2, and 7 before 7.1-PRERELEASE allow local users to gain privileges via unknown attack vectors related to function pointers that are "not properly initialized" for (1) netgraph sockets and (2) bluetooth sockets.
Exploits (2)
This exploit targets a FreeBSD kernel vulnerability (CVE-2008-4946) in the protosw structure to overwrite the credential structure, granting root privileges (euid=0) to the attacker's process. It uses memory mapping and a crafted payload to achieve local privilege escalation.
This exploit leverages a null pointer dereference in FreeBSD's Netgraph implementation (CVE-2008-5736) to achieve local privilege escalation. It maps the null page, injects a jump to shellcode, and triggers the vulnerability via a netgraph socket to gain root privileges.