Privilege escalation in NetBSD - #VU8201

Vulnerability identifier: #VU8201

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: N/A

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: NetBSD Foundation, Inc

Affected software:
NetBSD

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Vnode reference leak in the openat system call. When calling the openat system call using a file descriptor that does not name a directory as the starting point for path lookup, a reference to the underlying vnode is taken temporarily and then not released when the error is discovered. Performing such a call often enough results in overflowing the internal reference count and corrupting the kernel heap.

Successful exploitation of the vulnerability may allow an attacker to gain root access to the affected system.

The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarise how to upgrade your
kernel. In these instructions, replace:

  ARCH     with your architecture (from uname -m),
  KERNCONF with the name of your kernel configuration file and
  VERSION  with the file version below

File versions containing the fixes:

FILE  HEAD   netbsd-8   netbsd-7   netbsd-7-1   netbsd-7-0
----  ----   --------   --------   ----------   ----------
sys/kern/vfs_lookup.c
       1.208  1.207.2.1  1.201.4.1  1.201.12.1   1.201.8.1

To update from CVS, re-build, and re-install the kernel:

# cd src
# cvs update -d -P -r VERSION sys/kern/vfs_lookup.c
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-006.txt.asc