MNBSD-2016-12: 4.3BSD compat stat(2) kernel stack disclosure

Severity: Unknown

Affected Package: kernel

Summary: 4.3BSD compat stat(2) kernel stack disclosure

Description

The historic 4.3BSD-compatibility stat(2) system call did not clear the output struct before copying it out to userland. An unprivileged user could read uninitialized kernel stack memory, potentially exposing sensitive data useful for privilege escalation. Fixed in the 0.7.9 release.

Affected Versions

kernel

Recommendations

No specific recommendations provided.

References

Additional Information

Aliases:

Published: May 31, 2016
Last Modified: May 31, 2016