FreeBSD Security Advisory FreeBSD-SA-04:02.shmat – A programming error in the shmat(2) system call can result in a shared memory segment’s reference count being erroneously incremented. It may be possible to cause a shared memory segment to reference unallocated kernel memory, but remain valid. This could allow a local attacker to gain read or write access to a portion of kernel memory, resulting in sensitive information disclosure, bypass of access control mechanisms, or privilege escalation.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32632/FreeBSD-SA-04%3A02.shmat
Source: https://packetstormsecurity.com/files/32632/FreeBSD-Security-Advisory-2004.2.html