CVE-2004-2012

CVE-2004-2012 describes a privilege escalation vulnerability in the systrace_exit function of the systrace utility, affecting NetBSD-current, NetBSD 2.0 prior to April 16, 2004, and certain FreeBSD ports. This flaw allows local users to gain root privileges by not properly verifying the owner of the /dec/systrace connection before setting the effective user ID to 0. The vulnerability carries a CVSS score of 7.2, indicating high severity due to its local attack vector (AV:L), low attack complexity (AC:L), and complete compromise of confidentiality, integrity, and availability (C:C/I:C/A:C). This means an attacker with local access can easily exploit it to gain full control of the system. While not listed on the CISA KEV catalog or Hot List, an exploit (EDB-24113) is publicly available on ExploitDB. Community discussion is minimal, with only one mention, and there is no known active exploitation or Metasploit/Nuclei modules.