Privilege escalation in NetBSD



Published: 2017-09-19
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID N/A
CWE-ID CWE-362
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		NetBSD
Operating systems & Components / Operating system

Vendor NetBSD Foundation, Inc

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Race condition

EUVDB-ID: #VU8493

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges or cause DoS condition on the target system.

The weakness exists due to a missing check in the trap handler and the Linux compatibility layer. A local attacker can trigger race condition, cause the userland kernel space to panic and gain elevated privileges or cause the system to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

NetBSD: 6.0 - 7.1

CPE2.3 External links

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-005.txt.asc


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###