NetBSD vulnerabilities

A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.

NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.

NetBSD allows ARP packets to overwrite static ARP entries.

NetBSD on multi-homed hosts allows ARP packets from one network to modify ARP entries on another connected network.

In some cases, mount in NetBSD 1.3.3 allows local users to execute programs in file systems that have the 'noexec' flag set.