VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 22, 1999· Updated Apr 16, 2026

CVE-1999-0912

CVE-1999-0912

Description

FreeBSD VFS cache vulnerability allows local users to cause a denial of service by exhausting wired memory through file operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FreeBSD VFS cache vulnerability allows local users to cause a denial of service by exhausting wired memory through file operations.

Vulnerability

A vulnerability exists in FreeBSD versions 3.0, 3.1, and 3.2 due to the VFS cache's inability to purge entries from memory while files are open. This allows for the consumption of wired memory, which cannot be swapped out, leading to a denial of service condition. FreeBSD versions earlier than 3.0 are not affected [1].

Exploitation

A local user can exploit this vulnerability by opening a large number of files. The provided exploit code demonstrates this by creating numerous directories and hard links, which in turn causes the VFS cache to consume significant amounts of wired kernel memory [1].

Impact

Successful exploitation of this vulnerability results in a denial of service. The kernel's wired memory becomes exhausted, preventing normal system operations and potentially causing the system to become unresponsive.

Mitigation

This vulnerability affects FreeBSD versions 3.0, 3.1, and 3.2. No specific patched version or release date is mentioned in the available references. Users are advised to upgrade to a version of FreeBSD that is not affected by this issue, such as versions prior to 3.0 [1].

References
  1. FreeBSD 3.0/3.1/3.2 - 'vfs_cache' Denial of Service

AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

4
  • FreeBSD/FreeBSD4 versions
    cpe:2.3:o:freebsd:freebsd:3.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:freebsd:freebsd:3.0:*:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:3.1:*:*:*:*:*:*:*
    • cpe:2.3:o:freebsd:freebsd:3.2:*:*:*:*:*:*:*
    • (no CPE)

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The VFS cache in FreeBSD versions 3.0 through 3.2 does not properly manage memory for file entries when files are open, leading to excessive wired memory consumption."

Attack vector

A local user can exploit this vulnerability by opening a large number of files. The VFS cache retains entries in memory even when files are open, consuming wired memory that cannot be swapped out. This process can be repeated to exhaust available memory, causing a denial of service condition [ref_id=1].

Affected code

The vulnerability resides within FreeBSD's VFS cache, specifically introduced in version 3.0. The advisory indicates that the cache lacks a mechanism to purge entries from memory while a file associated with that entry remains open [ref_id=1].

What the fix does

The advisory does not specify a patch or provide details on how the vulnerability was fixed. However, it notes that FreeBSD versions earlier than 3.0 are not vulnerable, implying that a fix was introduced in later versions. Users are advised to upgrade to a fixed version of FreeBSD.

Preconditions

  • authThe attacker must have local user access to the affected system.
  • configThe affected system must be running FreeBSD versions 3.0, 3.1, or 3.2.

Reproduction

The provided reference includes C code that demonstrates how to trigger the vulnerability by creating a large number of directories and hard links, which in turn causes the VFS cache to consume excessive memory [ref_id=1].

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.