Permissions, Privileges, and Access Controls in NetBSD - #VU23650
Published: December 18, 2019
Vulnerability identifier: #VU23650
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: NetBSD Foundation, Inc
Affected software:
NetBSD
NetBSD
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to presence of filemon in default installation of NetBSD. The filemon module is experimental and is not recommended for running on production systems. However it gets automatically auto-loaded when /dev/fliemon is opened, and get accessible to every user on the system.
A local user can gain read/write access to the filemone module and perform a denial of service attack or gain elevated privileges on the system.
Remediation
Install updates from vendor's website.