CVE-2014-0998
FreeBSD 9.3-10.1 - Denial of Service and Privilege Escalation via VT_WAITACTIVE ioctl
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-0998.
AI-analyzed exploit summary This is a detailed technical writeup from Core Security describing multiple vulnerabilities in the FreeBSD kernel, including a sign conversion error in the vt console driver (CVE-2014-0998) and a memory corruption issue in SCTP socket handling (CVE-2014-8612). It includes root cause analysis, code snippets, and disassembly but does not contain functional exploit code.
Description
Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, which triggers an array index error and out-of-bounds kernel memory access.
Exploits (1)
This is a detailed technical writeup from Core Security describing multiple vulnerabilities in the FreeBSD kernel, including a sign conversion error in the vt console driver (CVE-2014-0998) and a memory corruption issue in SCTP socket handling (CVE-2014-8612). It includes root cause analysis, code snippets, and disassembly but does not contain functional exploit code.