SB2019121802 - Privilege escalation in NetBSD
Published: December 18, 2019
Security Bulletin ID
SB2019121802
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: N/A)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to presence of filemon in default installation of NetBSD. The filemon module is experimental and is not recommended for running on production systems. However it gets automatically auto-loaded when /dev/fliemon is opened, and get accessible to every user on the system.
A local user can gain read/write access to the filemone module and perform a denial of service attack or gain elevated privileges on the system.
Remediation
Install update from vendor's website.