FreeBSD -- File description reference count leak
If a process attempts to transmit rights over a UNIX-domain
socket and an error causes the attempt to fail, references
acquired on the rights are not released and are leaked.
This bug can be used to cause the reference counter to wrap
around and free the corresponding file structure.
A local user can exploit the bug to gain root privileges
or escape from a jail.
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright