Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1 when vfs.usermount is enabled allows local users to gain privileges via a crafted (1) mount or (2) nmount system call related to copying of \user defined data\ in \certain error conditions.\