The nullfs implementation in sys/fs/nullfs/null_vnops.c in the kernel in FreeBSD 8.3 through 9.2 allows local users with certain permissions to bypass access restrictions via a hardlink in a nullfs instance to a file in a different instance.
| Software | From | Fixed in |
|---|---|---|
| freebsd / freebsd | 8.0 | 8.0.x |
| freebsd / freebsd | 9.0 | 9.0.x |
| freebsd / freebsd | 9.1 | 9.1.x |
| freebsd / freebsd | 9.2 | 9.2.x |
| freebsd / freebsd | 8.4 | 8.4.x |
| freebsd / freebsd | 8.3 | 8.3.x |