The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segments reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freebsd | Freebsd | * | 5.2 (including) |
| Netbsd | Netbsd | * | 1.3 (including) |
| Openbsd | Openbsd | * | 2.6 (including) |