Information Disclosure in NetBSD Kernel via mm_open()

Executive Summary

CVE-2026-57843 is an information disclosure vulnerability in NetBSD where unprivileged local users can obtain real kernel virtual addresses by opening world-accessible devices like /dev/null or /dev/zero. These devices incorrectly receive the PK_KMEM process flag, allowing attackers to bypass kernel pointer obfuscation and read sensitive kernel structures via sysctl queries.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unprivileged users can access /dev/null or /dev/zero and retrieve kernel virtual addresses via sysctl KERN_PROC queries. Test by running commands like 'ls -l /dev/null' and 'sysctl kern.proc.all' as a non-root user to see if sensitive kernel addresses are exposed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read kernel memory addresses, which could be used to bypass security mechanisms, escalate privileges, or gain unauthorized access to sensitive system information. It primarily affects local users on systems running vulnerable NetBSD versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables information disclosure by exposing kernel virtual addresses, which could allow attackers to bypass memory protections and access sensitive kernel structures. While not directly violating GDPR or HIPAA, such information disclosure could facilitate further attacks that compromise personal or health data confidentiality, potentially leading to non-compliance with these regulations if exploited in systems handling such data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch referenced in the advisory for NetBSD versions 9.0 to 9.4 and 10.0 to 10.1. Until patched, restrict access to /dev/null and /dev/zero by modifying device permissions or using access control mechanisms to prevent unprivileged users from opening these devices.

Useful 0 Not Useful 0