3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
127 lines
4.7 KiB
Text
127 lines
4.7 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:09 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: fstatfs race condition may allow local denial of
|
|
service via procfs
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 2002-02-06
|
|
Credits: Stefan Esser <se@FreeBSD.org>
|
|
Affects: All released versions of FreeBSD prior to 4.5-RELEASE
|
|
Corrected: 2002-01-07 20:47:34 UTC (RELENG_4)
|
|
2002-01-17 15:46:46 UTC (RELENG_4_4)
|
|
2002-01-17 15:47:04 UTC (RELENG_4_3)
|
|
FreeBSD only: YES
|
|
|
|
I. Background
|
|
|
|
fstatfs() is a function that retrieves filesystem statistics in the
|
|
kernel. procfs is the process filesystem, which presents a filesystem
|
|
interface to the system process table and associated data.
|
|
|
|
II. Problem Description
|
|
|
|
A race condition existed where a file could be removed between calling
|
|
fstatfs() and the point where the file is accessed causing the file
|
|
descriptor to become invalid. This may allow unprivileged local users
|
|
to cause a kernel panic. Currently only the procfs filesystem is
|
|
known to be vulnerable.
|
|
|
|
III. Impact
|
|
|
|
On vulnerable FreeBSD systems where procfs is mounted, unprivileged
|
|
local users may be able to cause a kernel panic.
|
|
|
|
IV. Workaround
|
|
|
|
Unmount all instances of the procfs filesystem using the umount(8)
|
|
command by performing the following as root:
|
|
|
|
# umount -f -a -t procfs
|
|
|
|
Disable the automatic mounting of all instances of procfs in
|
|
/etc/fstab, remove or comment out the line(s) of the following form:
|
|
|
|
proc /proc procfs rw 0 0
|
|
|
|
Note that unmounting procfs may have a negative impact on the
|
|
operation of the system: under older versions of FreeBSD it is
|
|
required for some aspects of the ps(1) command, and unmounting it may
|
|
also break use of userland inter-process debuggers such as gdb. Other
|
|
installed binaries including emulated Linux binaries may require access
|
|
to procfs for correct operation.
|
|
|
|
V. Solution
|
|
|
|
1) Upgrade your vulnerable FreeBSD system to 4.5-RELEASE or
|
|
4.5-STABLE, or the RELENG_4_5, RELENG_4_4, or RELENG_4_3 security
|
|
branches dated after their respective correction dates.
|
|
|
|
2) FreeBSD 4.x systems prior to the correction date:
|
|
|
|
The following patch has been verified to apply to all FreeBSD 4.x
|
|
releases dated prior to the correction date. This patch may or may
|
|
not apply to older, unsupported releases of FreeBSD.
|
|
|
|
Download the patch and the detached PGP signature from the following
|
|
locations, and verify the signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch.asc
|
|
|
|
Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch -p < /path/to/patch
|
|
|
|
If procfs is statically compiled into the kernel (i.e. the kernel
|
|
configuration file contains the line 'options PROCFS'), rebuild
|
|
and reinstall your kernel as described in
|
|
http://www.freebsd.org/handbook/kernelconfig.html and reboot the
|
|
system with the new kernel for the changes to take effect.
|
|
|
|
If procfs is dynamically loaded by KLD (use the kldstat command to
|
|
verify whether this is the case) and the system securelevel has not
|
|
been raised, the system can be patched at run-time without
|
|
requiring a reboot by the execution of the following commands after
|
|
patching the source as described above:
|
|
|
|
# cd /usr/src/sys/modules/procfs
|
|
# make depend && make all install
|
|
# umount -f -a -t procfs
|
|
# kldunload procfs
|
|
# kldload procfs
|
|
# mount -a -t procfs
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the $FreeBSD$ revision numbers of the
|
|
file that was corrected in the FreeBSD source.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/sys/kern/vfs_syscalls.c
|
|
HEAD 1.216
|
|
RELENG_4 1.151.2.13
|
|
RELENG_4_4 1.151.2.9.2.1
|
|
RELENG_4_3 1.151.2.7.2.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.FreeBSD.org/cgi/query-pr.cgi?pr=32681>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBPGFTc1UuHi5z0oilAQGoMgP/REVJNr2Y+khbQAVX1VM+bnySdGxFKDVS
|
|
0niQ7ZrnI/Ffs7Kw0Nf5T82kvL2gFKRKPW1F2bl+A3qwDO2CBq/mKWLPuP+Ha/Id
|
|
oLtLeE446o/Gv6wdYpKzcdzUtPFcAhaPdD8DxSmdXyVjXuIYXgojM4wPgQcf5PVL
|
|
YW7uAAQ2cM0=
|
|
=T2JK
|
|
-----END PGP SIGNATURE-----
|