Description
The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.
References
- 18712 third-party-advisory
- http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html
- 405 third-party-advisory
- 16173 vdb-entry
- 18388 third-party-advisory
- 22293 vdb-entry
- netbsd-kernfs-memory-disclosure(24035) vdb-entry
- 20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion mailing-list