Executive brief
A vulnerability in the NetBSD kernel's cryptographic framework could allow a local user to crash the system. By providing specially crafted data to the system's encryption interface, an attacker can trigger a kernel panic, leading to a denial of service. This affects the stability and availability of the operating system but does not directly expose user data.
Technical details
A signed integer overflow exists in sys/opencrypto/cryptodev.c within the cryptodev_op() function. The local variable 'iov_len' is declared as a signed integer but is assigned an unsigned value from 'cop->dst_len'. If a local attacker provides a 'dst_len' value exceeding INT_MAX via /dev/crypto (specifically using a compression session type), it triggers undefined behavior. This results in corrupted UIO pointer arithmetic and a subsequent NULL pointer dereference, causing a kernel panic. The issue is mitigated if CONFIG_SVS is enabled but remains exploitable in other configurations. A fix was introduced in commit ec8451e.
Affected products
- NetBSD NetBSD prior to commit ec8451e
Timeline
- 2026-02-06: disclosed: Vulnerability research published by nasm.re
- 2026-04-29: patched: Fix committed to NetBSD source tree
- 2026-05-18: advisory: CVE-2026-32849 published