Description
kernfs_xread in kernfs_vnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://securitytracker.com/id?1015132 ↗
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c.diff?r1=1.110&r2=1.111&f=h ↗
- http://releng.netbsd.org/cgi-bin/req-3.cgi?show=727 ↗
- http://www.osvdb.org/20729 ↗
- http://www.packetstormsecurity.org/0601-advisories/NetBSD-SA2006-001.txt ↗
- http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html ↗
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c ↗