NetBSD Compression cryptodev.c cryptodev_op dst_len integer overflow

Summaryinfo

A vulnerability was found in NetBSD. It has been classified as problematic. Affected is the function cryptodev_op of the file sys/opencrypto/cryptodev.c of the component Compression Handler. This manipulation of the argument dst_len causes integer overflow. This vulnerability is registered as CVE-2026-32849. The attack needs to be launched locally. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability has been found in NetBSD (unknown version) and classified as problematic. Affected by this vulnerability is the function cryptodev_op of the file sys/opencrypto/cryptodev.c of the component Compression Handler. The manipulation of the argument dst_len with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect availability. The summary by CVE is:

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled and corrupted UIO pointer arithmetic.

It is possible to read the advisory at nasm.re. This vulnerability is known as CVE-2026-32849 since 03/16/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/18/2026).

Applying the patch ec8451efc1565516aba9e7047e1a1a1ce7953a2f is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Name

• NetBSD

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion