148 lines
5.7 KiB
Text
148 lines
5.7 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-17:08.ptrace Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Kernel data leak via ptrace(PT_LWPINFO)
|
|
|
|
Category: core
|
|
Module: ptrace
|
|
Announced: 2017-11-15
|
|
Credits: Ilja van Sprundel
|
|
John Baldwin
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2017-11-10 12:28:43 UTC (stable/11, 11.1-STABLE)
|
|
2017-11-15 22:39:41 UTC (releng/11.1, 11.1-RELEASE-p4)
|
|
2017-11-15 22:40:15 UTC (releng/11.0, 11.0-RELEASE-p15)
|
|
2017-11-10 12:31:58 UTC (stable/10, 10.4-STABLE)
|
|
2017-11-15 22:40:32 UTC (releng/10.4, 10.4-RELEASE-p3)
|
|
2017-11-15 22:40:46 UTC (releng/10.3, 10.3-RELEASE-p24)
|
|
CVE Name: CVE-2017-1086
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
0. Revision history
|
|
|
|
v1.0 2017-11-15 Initial release.
|
|
v1.1 2017-11-20 Corrected credit. Ilja van Sprundel first reported this
|
|
issue to the project, but wasn't cited. The FreeBSD
|
|
Security Team apologizes to Ilja for this oversight.
|
|
|
|
I. Background
|
|
|
|
The ptrace(2) syscall provides the facility for a debugger to control the
|
|
execution of the target process and to obtain necessary status information
|
|
about it. The struct ptrace_lwpinfo structure is reported by one of the
|
|
ptrace(2) subcommand and contains a lot of the information about the stopped
|
|
thread (light-weight process or LWP, thus the name).
|
|
|
|
II. Problem Description
|
|
|
|
Not all information in the struct ptrace_lwpinfo is relevant for the state
|
|
of any thread, and the kernel does not fill the irrelevant bytes or short
|
|
strings. Since the structure filled by the kernel is allocated on the
|
|
kernel stack and copied to userspace, a leak of information of the kernel
|
|
stack of the thread is possible from the debugger.
|
|
|
|
III. Impact
|
|
|
|
Some bytes from the kernel stack of the thread using ptrace(PT_LWPINFO)
|
|
call can be observed in userspace.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
Afterward, reboot the system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
Afterward, reboot the system.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-17:08/ptrace.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-17:08/ptrace.patch.asc
|
|
# gpg --verify ptrace.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/10/ r325643
|
|
releng/10.3/ r325871
|
|
releng/10.4/ r325870
|
|
stable/11/ r325642
|
|
releng/11.0/ r325869
|
|
releng/11.1/ r325868
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1086>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:08.ptrace.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEEHPf/b631yp++G4yy7Wfs1l3PaucFAloToMpfFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDFD
|
|
RjdGRjZGQURGNUNBOUZCRTFCOENCMkVENjdFQ0Q2NURDRjZBRTcACgkQ7Wfs1l3P
|
|
auf4EhAAkPiaUsEFju752S8RMKCC5LZtNMr++65TeX2I+QbvqR7jpcg8UhrVhonJ
|
|
0B/tEvaFcgYg8XjtHcRUMc5UzXRnZRu/a9+AzD2WbdZz/VqQSPVN1pAILXnYiZV4
|
|
SbmbKoavKzzQyXD9HTiElWCaOSau1dZYJj9CkhMarN63H5A+PNSD+v2TOcsK7S9h
|
|
Yvt4EYjq64CNO7BYY9vIUQEZkJfaoh2lLTOQYbaAgNbEa1+V4l7Kctzx0HpfrvmP
|
|
GyUyuvyIsBrtQA9xOYdhiet4qiORTNgVEsZc5k5mnpvvOOAyC5Ela/pqIM6VBmgv
|
|
9PS3RZkoEFblcJWbDb48sNfqVxXxG7NHMsun5YXA0eglmNQC/+pwibUZeJ4sTPLd
|
|
3qkm1uPxmHJPvp6zu/uVJSc+f8uJtMl7i2XmNVg0bdzzvcNkiCYR6TdhqZbDlJ+s
|
|
BjgSVjY5tH83t9F8yaenKBrtHLk3ybwKBMQ/T/nwfBnZtUtN6n3EHTWZxrroilCB
|
|
ein8XGKu4G2NuPcnY8X4Yn13LWHe/b46tj1nkvp+qkb+tN9tg7rsueoyJqLdM3k2
|
|
/KxAPKNgAgP05r7hIgJGEtblTaxvLIP+RvkuyRW9B0XSxfYUNPd9anIOQTMCTm3L
|
|
WFSYxQaW823LiKA3DvC7rw+8k9Jmcc7dVXaN1pwQMAroAxGhBM0=
|
|
=E16f
|
|
-----END PGP SIGNATURE-----
|