CVE-2010-2020

FreeBSD 7.2-8.1-PRERELEASE - Privilege Escalation via NFS Client fhsize Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-2020. PoCs published by Patroklos Argyroudis.

AI-analyzed exploit summary This exploit targets a kernel stack overflow in FreeBSD's nfs_mount() function via insufficient input validation, leading to local privilege escalation on FreeBSD 7.2/7.3 or DoS on FreeBSD 8.0. It leverages the nmount() system call with a crafted NFS file handle to overwrite kernel memory.

Description

sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length of a certain fhsize parameter, which allows local users to gain privileges via a crafted mount request.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Patroklos Argyroudis · clocalfreebsd
https://www.exploit-db.com/exploits/14002

This exploit targets a kernel stack overflow in FreeBSD's nfs_mount() function via insufficient input validation, leading to local privilege escalation on FreeBSD 7.2/7.3 or DoS on FreeBSD 8.0. It leverages the nmount() system call with a crafted NFS file handle to overwrite kernel memory.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: FreeBSD 7.2-RELEASE, 7.3-RELEASE, 8.0-RELEASE
No auth needed
Prerequisites: vfs.usermount sysctl set to non-zero · unprivileged user access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Patroklos Argyroudis · cdosfreebsd
https://www.exploit-db.com/exploits/14003

This exploit targets a kernel heap overflow in FreeBSD's mountnfs() function via insufficient input validation, leading to a denial-of-service (DoS) or potential privilege escalation. It leverages the nmount() system call with a maliciously crafted file handle to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: FreeBSD 8.0, 7.3, and 7.2
No auth needed
Prerequisites: vfs.usermount sysctl variable set to a non-zero value · unprivileged user access
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory x_refsource_freebsd
http://security.FreeBSD.org/advisories/FreeBSD-SA-10:06.nfsclient.asc
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14003
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14002
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1024039

Scores

EPSS 0.0087
EPSS Percentile 53.9%

Details

CWE
CWE-20
Status published
Products (3)
freebsd/freebsd 7.2 (3 CPE variants)
freebsd/freebsd 8.0
freebsd/freebsd 8.1-prerelease
Published May 28, 2010
Tracked Since Feb 18, 2026