CyberRota Analysis
AI-GeneratedNetBSD is vulnerable due to an information disclosure flaw in the mm_open() function, which allows unprivileged local users to access real kernel virtual addresses through world-accessible devices like /dev/null or /dev/zero. This misconfiguration permits attackers to bypass the CANSEE_KPTR obfuscation, potentially exposing sensitive kernel structures via sysctl KERN_PROC queries. System administrators and security teams managing NetBSD systems should prioritize addressing this vulnerability to mitigate the risk of unauthorized information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.