Description

NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-11T14:17:28.067Z",
  "pubdate": "2026-09-11T14:17:28.067Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified in the NetBSD kernel, specifically within the mm_open() function located in sys/dev/mm.c.\nThe issue arises from the incorrect assignment of the PK_KMEM process flag to unprivileged processes that open certain world-accessible character devices, such as /dev/null or /dev/zero.\nThe PK_KMEM flag is intended to grant elevated permissions to inspect kernel memory; its erroneous assignment allows an unprivileged local user to bypass the CANSEE_KPTR security mechanism, which is designed to obfuscate sensitive kernel pointers.\nBy gaining the ability to resolve real kernel virtual addresses, an attacker can enumerate sensitive data structures, including struct proc, kauth_cred, filedesc, and vmspace.\nThis vulnerability is exploitable by local, unprivileged users, significantly lowering the barrier for subsequent kernel-level attacks by providing the necessary memory layout information required for more complex exploits, such as kernel ROP chains or privilege escalation.\nThe primary risk is the total loss of kernel address space layout randomization (KASLR) effectiveness and the exposure of internal kernel objects to untrusted user-space entities.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of process flags within the mm_open() function in sys/dev/mm.c. When a process opens specific device nodes, the kernel incorrectly flags the process with PK_KMEM.\nThe PK_KMEM flag serves as a gatekeeper for sensitive kernel information. Typically, only processes with sufficient privileges should have this flag set, as it allows the process to bypass the CANSEE_KPTR check. The CANSEE_KPTR logic is a security feature that replaces raw kernel addresses with obfuscated or zeroed values when queried via sysctl or other monitoring interfaces to prevent unauthorized memory disclosure.\nIn this instance, opening /dev/null or /dev/zero—devices that should strictly be accessible to all users without granting elevated permissions—triggers the faulty logic path that sets the PK_KMEM flag in the caller's process structure.\nThe exploitation flow proceeds as follows: First, an unprivileged user opens a device such as /dev/null, which forces the kernel to modify the process's internal state. Second, due to the presence of the erroneously assigned PK_KMEM flag, the kernel's sysctl interface skips the security checks enforced by CANSEE_KPTR. Third, the attacker initiates a KERN_PROC query via sysctl, requesting information about system processes. Because the flag is set, the kernel returns raw, non-obfuscated memory addresses for critical structures.\nSpecifically, the attacker can extract pointers to struct proc (representing processes), kauth_cred (containing security credentials), filedesc (file descriptor tables), and vmspace (virtual memory management structures).\nWith these absolute kernel virtual addresses, the attacker can map the kernel's internal memory layout. This effectively neutralizes KASLR, allowing the attacker to locate specific functions or data structures for further exploitation. The vulnerability requires local access and no specific authentication beyond standard user privileges. The post-exploitation impact is severe, as the leaked information is a prerequisite for advanced kernel exploitation techniques, potentially leading to full system compromise or persistence."
}