CVE-2017-1000378
CriticalSummary
The qsort() function in NetBSD is recursive and not randomized, allowing an attacker to construct a pathological input array that causes deterministic recursion N/4 times. This enables attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks.
Risk Assessment
The risk to the organization involves the potential for arbitrary code execution by an attacker, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to update the NetBSD system to the latest version to mitigate the risk associated with this vulnerability and to monitor applications using the qsort() function.
Original NVD description (English source)
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions.