SB2022100441 - Multiple vulnerabilities in NetBSD

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Race condition (CVE-ID: N/A)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in mail.local(8) (/usr/libexec/mail.local), caused by an insufficient fix for #VU196 (CVE-2016-6253). A local user can exploit the race and escalate privileges on the system.

2) Permissions, Privileges, and Access Controls (CVE-ID: N/A)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing permission checks, which allows to reuse open descriptors, exposed in the procfs(5) [pid]/fd/ directory. A local user can bypass permission checks and read data from opened descriptor.

3) Use-after-free (CVE-ID: N/A)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in coredump handling code. A local user can trigger a use-after-free error and escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-003.txt.asc
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-004.txt.asc
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-002.txt.asc