procfs in BSD systems allows local users to gain root privileges by modifying the /proc/pid/mem interface via a modified file descriptor for stderr.
NetBSD ptrace call on VAX allows local users to gain privileges by modifying the PSL contents in the debugging process.
The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.
NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another connected network.
NetBSD allows ARP packets to overwrite static ARP entries.
The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associated with t…
umapfs allows local users to gain root privileges by changing their uid through a malicious mount_umap program.