Remote Kernel Null Pointer Dereference in NetBSD ipfilter Fixed in 10.2 Release
What Happened – NetBSD 10.2 ships a kernel patch that closes a remotely‑triggerable null‑pointer dereference in the ipfilter module, a flaw that could crash the operating system. The same release also stops a 4‑byte kernel‑stack leak via TCP timestamps and updates bundled third‑party components (OpenSSL 3.0.21, Xorg 21.1.24, libXpm, Unbound CVE‑2025‑11411, etc.).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous patch‑management program that can detect, test, and deploy kernel‑level fixes before an attacker can exploit them.
- Provides verifiable evidence (PGP‑signed hashes, upgrade logs) that can be collected and presented during audits to prove due‑diligence.
- Highlights the importance of maintaining an up‑to‑date software‑bill‑of‑materials, a core control for many frameworks (e.g., NIST CSF 2.0 “Protect” function).
Who Is Affected – Organizations that run NetBSD on edge routers, firewalls, or any server role where ipfilter is used – common in cloud‑infrastructure, telecom back‑bones, and research‑grade Unix environments.
Recommended Actions
- Verify current NetBSD version; if < 10.2, schedule an upgrade following the documented order (kernel → reboot → userspace).
- Validate the integrity of the upgrade image using the NetBSD Security Officer’s PGP key.
- Update all third‑party packages (OpenSSL, Xorg, libXpm, Unbound) to the versions shipped with 10.2.
- Record the upgrade steps in your change‑management system to create audit‑ready evidence of remediation.
Technical Notes – The vulnerability is a remote kernel‑mode null‑pointer dereference (no CVE assigned) that results in a denial‑of‑service. The TCP‑timestamp leak (4 bytes) can disclose kernel addresses, aiding future exploits. No public exploit code is known, but the attack surface is remote. Source: Help Net Security