145 lines
5.6 KiB
Text
145 lines
5.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-15:02.kmem Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: SCTP SCTP_SS_VALUE kernel memory corruption and disclosure
|
|
|
|
Category: core
|
|
Module: sctp
|
|
Announced: 2015-01-27
|
|
Credits: Clement LECIGNE from Google Security Team and
|
|
Francisco Falcon from Core Security Technologies
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2015-01-27 19:36:08 UTC (stable/10, 10.1-STABLE)
|
|
2015-01-27 19:37:02 UTC (releng/10.1, 10.1-RELEASE-p5)
|
|
2015-01-27 19:37:02 UTC (releng/10.0, 10.0-RELEASE-p17)
|
|
2015-01-27 19:36:08 UTC (stable/9, 9.3-STABLE)
|
|
2015-01-27 19:37:02 UTC (releng/9.3, 9.3-RELEASE-p9)
|
|
2015-01-27 19:36:08 UTC (stable/8, 8.4-STABLE)
|
|
2015-01-27 19:37:02 UTC (releng/8.4, 8.4-RELEASE-p23)
|
|
CVE Name: CVE-2014-8612
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
SCTP protocol provides reliable, flow-controlled, two-way transmission
|
|
of data. It is a message oriented protocol and can support the SOCK_STREAM
|
|
and SOCK_SEQPACKET abstractions.
|
|
|
|
SCTP allows the user to choose between multiple scheduling algorithms to
|
|
optimize the sending behavior of SCTP in scenarios with different
|
|
requirements.
|
|
|
|
II. Problem Description
|
|
|
|
Due to insufficient validation of the SCTP stream ID, which serves as an array
|
|
index, a local unprivileged attacker can read or write 16-bits of kernel
|
|
memory.
|
|
|
|
III. Impact
|
|
|
|
An unprivileged process can read or modify 16-bits of memory which
|
|
belongs to the kernel. This smay lead to exposure of sensitive
|
|
information or allow privilege escalation.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:02/sctp.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-15:02/sctp.patch.asc
|
|
# gpg --verify sctp.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r277807
|
|
releng/8.4/ r277808
|
|
stable/9/ r277807
|
|
releng/9.3/ r277808
|
|
stable/10/ r277807
|
|
releng/10.0/ r277808
|
|
releng/10.1/ r277808
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
We would like to acknowledge Clement LECIGNE from Google Security Team and
|
|
Francisco Falcon from Core Security Technologies who discovered the issue
|
|
independently and reported to the FreeBSD Security Team.
|
|
|
|
<URL:http://www.coresecurity.com/content/freebsd-kernel-multiple-vulnerabilities>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8612>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:02.kmem.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.1 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJUx+qPAAoJEO1n7NZdz2rndPwQAJYuUZhkBqt6Lj0Wnuu220QL
|
|
OwMQAVBDggfNMJj5GCMRYqniARGg53UpzBjbKyen9N7tQtjgF6ll9EcWQhUdQSSl
|
|
07iCLGkn7kAu5jRO7+S/fJLXaUBfo+KfrUakHBdrWGKD0VVp/DDMbjbzZWl8Yw0S
|
|
7g0tqSmNcR1uUbAAsSXUfN9N/8OZzkqCiDvmVcFtalw1CjFyl6XbYXxNS+/j7LrU
|
|
YQBJdz9F/X/oPe19VQ36olZWzTdlSLwa/ylwNW7O6K5NdoCq73Co4IDL0gkAgtdQ
|
|
s4A7h4UwEoYleRRX+g9Rbeq2tz9FwfIwSferFRF5/1thc0cVJ2e/oDq9lmzyepwa
|
|
rbH8jy/TMtSKHlali8I3w6KYfqRFs6whS9Bud1b0SgrqqZizsO64BbvSzkELxHJl
|
|
PMUPHHCh3w0CXnRcaxC+rY/kazPZeRzebMaxQLAV0KTEVp0aSGw7FBtEE+ldrHUd
|
|
rp1bLESjTjtagr1K1UsCKKZr/t9RSHSZ1I6vfxBPUsUu7oUgd+aOmEpiyYKxna0y
|
|
vS5ECCrJG4k9fsQ1emyB5NhROYCXdq2CavfWWOOi3LoUhVvh34N27HVZlqv2m3Y9
|
|
sM20xOB3dSx3ufsv19nAclVpL76Pu7fD/MNe+lhUk1KKgqx0L7vdiJfMIrafLYsR
|
|
V2Rre46fapln8T+wvhQP
|
|
=o9yw
|
|
-----END PGP SIGNATURE-----
|