Executive brief
NetBSD's device memory access system incorrectly grants kernel memory privileges to unprivileged users opening standard devices like /dev/null and /dev/zero. This misconfiguration allows attackers to bypass kernel pointer obfuscation protections and extract sensitive kernel memory addresses, which can be used to defeat kernel address space layout randomization and facilitate further attacks against the operating system.
Technical details
The vulnerability exists in mm_open() within sys/dev/mm.c, where world-accessible memory devices incorrectly receive the PK_KMEM process flag during opening. This flag is intended only for privileged processes that need legitimate kernel memory access. The flaw allows unprivileged local users to bypass the CANSEE_KPTR obfuscation mechanism, which normally hides kernel virtual addresses from non-root users. Attackers can then query sysctl KERN_PROC endpoints to read kernel virtual addresses for sensitive structures including struct proc, kauth_cred, filedesc, and vmspace. The attack requires local access to the system but no special privileges or user interaction. Patches have been committed to NetBSD and are available in current and stable release branches.
Affected products
- NetBSD NetBSD 9.0 to <9.5, 10.0 to 10.1
Timeline
- 2026-09-11: disclosed
- 2026-06-27: patched: Fix committed to HEAD