Local Privilege Escalation in NetBSD and OpenBSD with USER_LDT Option

CVE-2001-0268

What is CVE-2001-0268?

The i386_set_ldt system call in NetBSD 1.5 and earlier, as well as OpenBSD 2.8 and earlier, contains a vulnerability when the USER_LDT kernel option is enabled. This flaw allows local users to manipulate the Local Descriptor Table (LDT) to create a segment call gate with a target that points to an arbitrary kernel address. By doing so, an attacker can escalate their privileges to root, gaining unauthorized access to sensitive kernel memory and resources. This issue underscores the importance of stringent validation checks in system calls to prevent unauthorized privilege escalation.

References