Local Privilege Escalation in NetBSD on x86 Platforms

CVE-2009-2793

What is CVE-2009-2793?

The kernel in NetBSD, particularly on x86 platforms, fails to handle pre-commit failures of the iret instruction appropriately. This oversight can enable local users to exploit the tempEIP pseudocode variable, potentially allowing them to gain unauthorized privileges beyond the intended code-segment limits. As a result, affected versions of NetBSD are vulnerable to local privilege escalation attacks, which can compromise system integrity and expose sensitive information.

References