CVE-2026-57843: NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure
NetBSD contains an information disclosure vulnerability in mmopen() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEEKPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauthcred, filedesc, and vmspace via sysctl KERNPROC queries.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Unprivileged local users are exposed when they can open world-accessible devices such as /dev/null or /dev/zero. The issue is local-only; the provided data does not describe a remote attack path.
What does an attacker need to do to exploit it?
An attacker needs local access with a low-privileged account and must open an affected world-accessible device. They can then use sysctl KERN_PROC queries to obtain unobfuscated kernel virtual addresses for sensitive kernel structures.
Are default device permissions relevant?
Yes. Exploitation depends on devices being world-accessible, specifically including examples such as /dev/null and /dev/zero. Those devices incorrectly receive the PK_KMEM process flag when opened.
How can defenders determine whether the issue is being exposed?
Check whether unprivileged users can open /dev/null, /dev/zero, or other world-accessible devices, and whether their processes can retrieve real rather than obfuscated kernel pointers through sysctl KERN_PROC queries. The disclosed pointers may include addresses for struct proc, kauth_cred, filedesc, and vmspace.