Tristan Clerc

NetBSD contains a use-after-free and double-free vulnerability in msg recv copyin() within the COMPAT NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg iovlen between 9 and IOV MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.

NetBSD contains an information disclosure vulnerability in mm open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth cred, filedesc, and vmspace via sysctl KERN PROC queries.