CVE-2017-1000374
CriticalSummary
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
Risk Assessment
This vulnerability may lead to unauthorized system access and execution of malicious code, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest version of NetBSD to mitigate this vulnerability and to monitor the use of setuid binaries in the system.
Other vulnerabilities in NetBSD
See all- CVE-2026-57843Medium
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures.
- CVE-2026-57842High
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX.
- CVE-2026-32849Medium
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.
- CVE-2026-32848Medium
NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.
- CVE-1999-0764Medium
NetBSD allows ARP packets to overwrite static ARP entries.
- CVE-1999-0763Medium
NetBSD on multi-homed hosts allows ARP packets from one network to modify ARP entries on another connected network.
- CVE-1999-0422Medium
In some cases, mount in NetBSD 1.3.3 allows local users to execute programs in file systems that have the 'noexec' flag set.
Original NVD description (English source)
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.