PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-1883 Freebsd CVE debrief

CVE-2016-1883 describes a local privilege-escalation issue in the issetugid system call within FreeBSD's Linux compatibility layer. The supplied NVD data says the bug affects FreeBSD 9.3, 10.1, and 10.2, and that local users may gain privilege through unspecified vectors. Because the CVSS 3.0 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the practical defensive concern is a low-complexity local escalation path with high impact on confidentiality, integrity, and availability.

Vendor
Freebsd
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

FreeBSD administrators and security teams running or supporting FreeBSD 9.3, 10.1, or 10.2, especially systems that permit local logins, shared shells, or untrusted local workloads. Teams using the Linux compatibility layer on affected hosts should treat this as a priority local-privilege risk.

Technical summary

According to the provided NVD record, the vulnerability is in the Linux compatibility layer's issetugid system call on affected FreeBSD releases. The weakness is categorized as CWE-264 in the supplied metadata. The attack is local, requires low privileges, and does not need user interaction. NVD lists full CIA impact in the CVSS vector, but the corpus does not specify the exact triggering sequence or a fixed-version statement.

Defensive priority

High

Recommended defensive actions

  • Identify any FreeBSD 9.3, 10.1, or 10.2 systems still in service and mark them as affected.
  • Follow the FreeBSD vendor advisory referenced by NVD and apply the vendor-supplied remediation or upgrade guidance.
  • Prioritize remediation on hosts that allow local user access or run untrusted workloads, since the issue requires local access.
  • Enforce least privilege and restrict unnecessary local account access until affected systems are remediated.
  • Review affected systems for unexpected privilege changes or other signs of local escalation activity.
  • Track this CVE separately from network-facing issues; perimeter controls do not mitigate a local privilege-escalation flaw.

Evidence notes

The supplied corpus contains: NVD metadata for CVE-2016-1883, published 2017-02-15 and modified 2026-05-13; affected CPEs for FreeBSD 9.3, 10.1, and 10.2; CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; weakness CWE-264; and references to the FreeBSD vendor advisory FreeBSD-SA-16:10.linux and a third-party advisory/VDB entry. The description explicitly says the issue is in the Linux compatibility layer and that local users may gain privilege via unspecified vectors.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-1883 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-1883

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-1883 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-1883

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.