Unscored severity · published Dec 26, 2006
CVE-2006-6730
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by…
–
CVSS
0.3%
EPSS
No
On KEV
Description
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86 (aka the video card memory-mapped I/O range), and then launching the new handler via a System Management Interrupt (SMI), as demonstrated by a write to Programmed I/O port 0xB2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netbsd · Netbsd
2.0.4 · source: NVD
OP
Openbsd · Openbsd
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6730
lists.freedesktop.org
http://lists.freedesktop.org/archives/xorg/2004-June/000927.html
www.cansecwest.com
http://www.cansecwest.com/slides06/csw06-duflot.ppt
www.securityfocus.com
http://www.securityfocus.com/archive/1/454379/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/454510/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/454706/100/0/threaded
www.ssi.gouv.fr
http://www.ssi.gouv.fr/fr/sciences/fichiers/lti/cansecwest2006-duflot-paper.pdf
More from Netbsd
9.8
CVE-2017-1000378
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse…
9.8
CVE-2017-1000375
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary…
9.8
CVE-2017-1000374
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries
9.8
CVE-2015-8212
CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled…
9.8
CVE-2003-0466
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0…