Design/Logic Flaw

2006-01-0923:03:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.8%

JSON

The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.

CPENameOperatorVersion
netbsdeq1.6
netbsdeq2.1
netbsdeq2.0.2
netbsdeq1.6.1
netbsdeq2.0.3
netbsdeq1.6.2
netbsdeq1.6 beta
netbsdeq2.0.1
netbsdeq2.0

Name	Operator	Version
netbsd	eq	1.6
netbsd	eq	2.1
netbsd	eq	2.0.2
netbsd	eq	1.6.1
netbsd	eq	2.0.3
netbsd	eq	1.6.2
netbsd	eq	1.6 beta
netbsd	eq	2.0.1
netbsd	eq	2.0

References

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-001.txt.asc

secunia.com/advisories/18388

secunia.com/advisories/18712

securityreason.com/securityalert/405

www.osvdb.org/22293

www.securityfocus.com/archive/1/423827/100/0/threaded

www.securityfocus.com/bid/16173

www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html

exchange.xforce.ibmcloud.com/vulnerabilities/24035