| Newsgroups |
gmane.os.netbsd.bugs |
| Message-ID |
<[email protected]> |
>Number: 60492
>Category: kern
>Synopsis: hdaudio(4): setconfig is allowed unprivileged
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Thu Jul 23 21:45:00 +0000 2026
>Originator: Taylor R Campbell
>Release: current, 11, 10, 9, ...
>Organization:
The NetBSD Foundaudio, Inconfigured
>Environment:
>Description:
The ioctl(HDAUDIO_FGRP_SETCONFIG) command is available to
anyone with any access -- including read-only -- to
/dev/hdaudioN with no write access checks.
This can be used to trigger config_detach / config_found, and
if there are any races in those (which is often the case),
might be exploitable for local privilege escalation.
Forwarded to us by Khushali Dalal <[email protected]>.
>How-To-Repeat:
1. Build hdaudioctl(8) so that it opens /dev/hdaudioN O_RDONLY
instead of O_RDWR.
2. hdaudioctl set ...
>Fix:
Add access checks to hdaudioioctl.