Threat Intelligence Database

NetBSD has an information disclosure vulnerability in the mm_open() function in sys/dev/mm.c. This flaw allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices like /dev/null or /dev/zero. These devices incorrectly receive the PK_KMEM process flag, enabling attackers to bypass the CANSEE_KPTR obfuscation mechanism. Exploitation can reveal sensitive kernel structures such as struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries. The vulnerability affects NetBSD versions from 9.0 up to but not including 9.5, and versions 10.0 through 10.1 inclusive. The CVSS 4.0 base score is 6.8, indicating medium severity.

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.