Glonce

NetBSD 11.0 ships with three known open security issues

miscThe Glonce editorsHacker News🔥51Glonce rating51Impact30Novelty20Relevance45Surprise25Players35Credibility90

The NetBSD project has released NetBSD 11.0. The release had already been pushed back while the team waited for third party components to reach stable versions so their fixes could be pulled in, and the release process itself still needs manual steps, such as a security officer signing the release hashes, on top of the time it takes to transfer every file for every supported architecture over the network. Rather than delay further, the project decided to ship 11.0 with three known open security issues and be transparent about them instead of chasing a moving target, since new reports keep coming in. The three issues are: a missing local user privilege check in the hdaudio(4) driver's ioctl commands (PR 60492), which has an easy manual workaround of removing the /dev/hdaudio* device nodes, after which audio still works; a remotely triggerable null pointer dereference in ipfilter (PR 60484), a packet filter that is not included in any released kernel by default; and a use after free bug in pf's fragment reassembly code (PR 60485), also not included by default and already deprecated. The project says all three fixes will be committed to the stable branch shortly after this release and will ship in NetBSD 11.1, which it is aiming to release within about two months. On the practical side, install images have been split so that images under 700MB are offered for CD-ROM media, with full sized DVD images available for those not limited by CD capacity; ARM based devices get a netbsd-11 image pre-configured with U-Boot from the bootable ARM images page; and anyone installing from flash media such as a USB drive must use the .img files rather than the .iso images, decompressing them first with a tool like gunzip or 7-Zip.

Key facts

  • NetBSD 11.0 is out after a delay caused by waiting for third party components to reach stable releases.
  • The release ships with three known open security issues instead of being delayed further: hdaudio(4) (PR 60492), ipfilter (PR 60484), and pf (PR 60485).
  • Neither ipfilter nor pf is included in any released kernel by default, and pf is already deprecated; the hdaudio(4) issue has a manual workaround of removing /dev/hdaudio*.
  • Fixes for all three issues are slated for the stable branch and for NetBSD 11.1, targeted for release within about two months.
  • Install media has been reorganized: sub-700MB images for CD-ROM versus full DVD images, a pre-configured U-Boot image for ARM devices, and .img (not .iso) files required for flash media installs.

Why it matters

It is a routine but notable release for a long running open source BSD operating system project. What stands out is the project's choice to publish with known open issues and say so plainly, rather than keep delaying the release while new reports keep surfacing, a decision the announcement explicitly links to a broader rise in reported or suspected security issues since AI tools became widespread.

Who it affects

NetBSD users and system administrators across its supported hardware architectures, including ARM based device owners who get a pre-configured U-Boot image, and anyone installing from flash media such as a USB drive.

How to use it

Installers should check the installation notes for their architecture and grab the appropriate image from the CDN. CD-ROM users want the under 700MB images, while anyone not limited by CD capacity should pick the full sized DVD image. Flash media installs, such as a USB drive, require the .img files rather than .iso images, decompressed first with a tool such as gunzip or 7-Zip. ARM based devices should use the pre-configured netbsd-11 image with U-Boot from the bootable ARM images page.

How solid is it

The retelling draws entirely from the NetBSD project's own release announcement blog post, a primary source with specific problem report numbers for each open issue, so the account is well grounded even though it is a single source.

Risks and caveats

Three security issues remain open in this release: a missing local privilege check in hdaudio(4) ioctl commands, worked around by removing /dev/hdaudio* device nodes; a remotely triggerable null pointer dereference in ipfilter; and a use after free bug in pf's fragment reassembly. Both ipfilter and pf are excluded from released kernels by default, which limits exposure, but users who have enabled them, or who rely on hdaudio(4), should note the fixes are not in 11.0 itself and are instead planned for the stable branch and for NetBSD 11.1 in about two months.

“the number of security issues found or suspected everywhere has massively increased with the advent of AI tools”

— NetBSD project, 11.0 release announcement