Approved changes feed: RSS · Atom
cpe:2.3:a:netbsd:src:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Netbsd (d97e796d-00dc-5b79-b428-0d0c6adaeef6) |
|---|---|
| Product | Src (f4bef7d9-04db-50da-95c6-8d19c287d1e3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32849 |
vulnerable | 2026-06-08 07:57:18.194462 |
NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.c
MEDIUM (5.5)
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled and corrupted UIO pointer arithmetic.
Published: 2026-05-18T17:42:29.642Z
Updated: 2026-07-14T18:40:02.277Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32848 |
vulnerable | 2026-06-08 07:57:18.193980 |
NetBSD cryptodev Race Condition Double-Free via cryptodev_op()
MEDIUM (4.7)
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.
Published: 2026-05-18T17:52:55.753Z
Updated: 2026-07-14T18:40:01.569Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.