CVE-2006-6655: Null Pointer Dereference

Published Dec 20, 2006

Updated

The procfs implementation in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (kernel panic) by attempting to access /emul/linux/proc/0/stat on a procfs filesystem that was mounted with mountprocfs -o linux, which results in a NULL pointer dereference.

Affected Software

4 affected components

NetBSD NetBSD=2.1

NetBSD NetBSD=3.0.1

NetBSD NetBSD=3.0

NetBSD NetBSD=2.0

Remediation

Patch Available

http://securitytracker.com/id?1017293

Event History

Dec 20, 2006

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:28 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2006-6655?

CVE-2006-6655 is a medium severity vulnerability that can lead to a denial of service through kernel panic.

How do I fix CVE-2006-6655?

Fix CVE-2006-6655 by upgrading to the latest version of NetBSD that incorporates the patch released after October 2006.

Who is affected by CVE-2006-6655?

CVE-2006-6655 affects local users of NetBSD versions 2.0, 2.1, 3.0, and 3.0.1 prior to specified patch dates.

What causes the vulnerability CVE-2006-6655?

CVE-2006-6655 is caused by improper handling of the procfs implementation when accessing specific proc files.

Is CVE-2006-6655 specific to a certain operating system?

Yes, CVE-2006-6655 specifically affects the NetBSD operating system in the specified versions and configurations.