Chris Jarrett-Davies

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** An issue exists in the implementation of largepage shared memory objects where pages were not explicitly wired. When the `sendfile(2)` function transmits such an object using the `SF NOCACHE` flag, it frees the underlying pages after transmission despite existing mappings still referring to them. This use-after-free condition allows an unprivileged local user to access freed kernel memory, which can be exploited to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** Insufficient input validation in the implementation of largepage shared memory objects allows an unprivileged local user to access freed kernel memory. This occurs because certain system calls, such as `open(2)` with the `O TRUNC` flag set and `fspacectl(2)`, do not verify if the operation is permitted on largepage objects, leading to the incorrect freeing of memory. This flaw can be exploited to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.