NetBSD kernfs kernel memory information leak

It's possible to lseek behind file boundary to read arbitrary memory...

[SLAB] NetBSD / OpenBSD kernfs_xread patch evasion

--- SecurityLab Technologies, Inc. --- Security Advisory --- http://www.securitylab.net Advisory Name: NetBSD / OpenBSD kernfsxread patch evasion Release Date: February 02, 2006 Application: kernfs Platform: NetBSD / OpenBSD Severity: Severe Author: SLAB Research Vendor Status: Patched Reference:...

CVE-2005-4691

CVE-2005-4691 covers a local privilege issue in imake across NetBSD (before 2.0.3 and NetBSD-current before 2005-09-12) and certain X.Org/XFree86 versions. The vulnerability arises from a symlink attack on the temporary file used for the file.0 target, allowing a local user to overwrite arbitrary...

CVE-2005-4691

imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack on the temporary file for the file.0 target, which is used for a pre-formatted manual page...

NetBSD Security Advisory 2006-002: settimeofday() time wrap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2006-002 ================================= Topic: settimeofday time wrap Version: NetBSD-current: source prior to December 5, 2005 NetBSD 3.0: not affected NetBSD 2.1: affected NetBSD 2.0.3: affected NetBSD 1.6.2: affected...

NetBSD Security Advisory 2006-001: Kernfs kernel memory disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2006-001 ================================= Topic: Kernfs kernel memory disclosure Version: NetBSD-current: source prior to November 23, 2005 NetBSD 3.0: not affected NetBSD 2.1: affected NetBSD 2.0.3: affected NetBSD 2.0:...

CVE-2006-0145

The kernfsxread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call...

CVE-2006-0145

The CVE-2006-0145 entry concerns the kernfs_xread function in kernfs for NetBSD (versions 1.6–2.1) and OpenBSD 3.8. The issue is improper validation of file offsets against negative 32-bit values that occur due to truncation, enabling local users to read arbitrary kernel memory and potentially ga...

CVE-2006-0145

The kernfsxread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call...

CVE-2005-4352

The CVE-2005-4352 entry documents a time-wrap flaw in BSD securelevels affecting NetBSD 2.1 and earlier and Linux 2.6.15 and earlier. The root cause is an integer overflow in securelevels that allows a local user to bypass time-change restrictions by setting the clock forward to the 32‑bit Unix e...

CVE-2005-4352

The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value 19 Jan 2038, which then wraps around to the minimum value 13 Dec 190...

[Full-disclosure] Time modification flaw in BSD securelevels on NetBSD and Linux

Advisory: Time modification flaw in BSD securelevels on NetBSD and Linux The implementations of securelevels on NetBSD and Linux contain an integer overflow, allowing the protection of system time to be completely circumvented. Details ======= Product: NetBSD Linux Affected Versions:...

CVE-2005-4352

The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value 19 Jan 2038, which then wraps around to the minimum value 13 Dec 190...

CVE-2005-4783

kernfsxread in kernfsvnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory...

CVE-2005-4691

imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack on the temporary file for the file.0 target, which is used for a pre-formatted manual page...

CVE-2005-4733

NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service infinite loop and system hang by calling the FCLOSEM fcntl with a parameter value of 0...

CVE-2005-4352

The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value 19 Jan 2038, which then wraps around to the minimum value 13 Dec 190...

CVE-2005-4782

NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denial of service kernel assertion panic via a negative linger time in the SOLINGER socket option...

CVE-2005-4741

NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid PSUGID process that performs an exec without a reset of real credentials...

CVE-2005-4776

Integer overflow in the FreeBSD compatibility code freebsdmisc.c in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 before 20050914; allows local users to cause a denial of service heap corruption or system crash and possibly gain root privileges...