Description
kernfs_xread in kernfs_vnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory.
References
- 1015132 vdb-entry
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c.diff?r1=1.110&r2=1.111&f=h
- http://releng.netbsd.org/cgi-bin/req-3.cgi?show=727
- 20729 vdb-entry
- NetBSD-SA2006-001 vendor-advisory
- [netbsd-announce] 20051031 Announcing update 2.0.3 - source only mailing-list
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c