CVE-2017-1000378: Critical severity netbsd current vulnerability
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000378?
CVE-2017-1000378 is considered a high severity vulnerability due to its potential to cause stack overflow and Denial of Service attacks.
How do I fix CVE-2017-1000378?
To fix CVE-2017-1000378, upgrade to a version of NetBSD that includes the patch for the qsort() implementation, specifically versions newer than 7.1.
What systems are affected by CVE-2017-1000378?
CVE-2017-1000378 affects NetBSD versions up to and including 7.1.
What type of attack can be executed using CVE-2017-1000378?
CVE-2017-1000378 allows attackers to exploit the vulnerability to perform Denial of Service attacks through stack memory exhaustion.
Is CVE-2017-1000378 a local or remote vulnerability?
CVE-2017-1000378 can be exploited locally by an attacker who has the ability to provide crafted input to the qsort() function.