Description (CNA)
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The NetBSD Foundation / NetBSD | affected 9.0 before 9.5; affected 10.0 through 10.1 |
CWE
CWE-732
References
- https://gnats.netbsd.org/60373
- https://www.vulncheck.com/advisories/netbsd-mm-open-pk-kmem-flag-kernel-pointer-information-disclosure
ADP enrichment
No English description supplied.
No references supplied.