3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
107 lines
3.8 KiB
Text
107 lines
3.8 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:44.filedesc Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: file descriptor leak in fpathconf
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 2003-01-07
|
|
Credits: Joost Pol <joost@pine.nl>
|
|
Affects: FreeBSD 4.3-RELEASE and later versions
|
|
Corrected: 2002-11-11 01:43:31 UTC (RELENG_4)
|
|
2003-01-06 12:37:52 UTC (RELENG_4_7)
|
|
2003-01-06 12:38:21 UTC (RELENG_4_6)
|
|
2003-01-07 15:17:16 UTC (RELENG_4_5)
|
|
2003-01-07 15:17:40 UTC (RELENG_4_4)
|
|
2003-01-06 21:20:54 UTC (RELENG_5_0)
|
|
FreeBSD only: YES
|
|
|
|
0. Revision History
|
|
|
|
2003-01-06 v1.0 Initial release.
|
|
2003-01-07 v1.1 Added information regarding bug in FreeBSD 5.x.
|
|
Added correction details for RELENG_4_5, RELENG_4_4.
|
|
|
|
I. Background
|
|
|
|
The fpathconf system call provides a method for applications to
|
|
determine the current value of a configurable system limit or option
|
|
variable associated with a pathname or file descriptor.
|
|
|
|
II. Problem Description
|
|
|
|
A programming error in the fpathconf system call can result in the
|
|
given file descriptor's reference count being erroneously incremented.
|
|
|
|
A similar problem exists in the developer preview versions of FreeBSD
|
|
5.0, affecting the lseek(2), dup(2), and other system calls.
|
|
|
|
III. Impact
|
|
|
|
A local attacker may cause the operating system to crash by repeatedly
|
|
calling fpathconf on a file descriptor until the reference count wraps
|
|
to a negative value, and then calling close on that file descriptor.
|
|
|
|
Similarly, it may be possible to cause a file descriptor to reference
|
|
unallocated kernel memory, but remain valid. If a new file is later
|
|
opened and the kernel allocates the new file structure at the same
|
|
memory location, then an attacker may be able to gain read or write
|
|
access to that file. This may in turn lead to privilege escalation.
|
|
|
|
IV. Workaround
|
|
|
|
There is no workaround.
|
|
|
|
V. Solution
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.4, 4.5,
|
|
4.6, and 4.7 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch.asc
|
|
|
|
b) Apply the patch.
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/sys/kern/kern_descrip.c
|
|
RELENG_4 1.81.2.15
|
|
RELENG_4_7 1.81.2.14.4.1
|
|
RELENG_4_6 1.81.2.14.2.1
|
|
RELENG_4_5 1.81.2.9.2.3
|
|
RELENG_4_4 1.81.2.8.2.3
|
|
RELENG_5_0 1.169.2.2
|
|
src/sys/kern/vfs_syscalls.c
|
|
RELENG_5_0 1.297.2.2
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.pine.nl/press/pine-cert-20030101.txt>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.2.1 (FreeBSD)
|
|
|
|
iD8DBQE+GxDCFdaIBMps37IRAkDtAJ9Ma79bfwhHHBMe1v0gVgvzrFtoMgCgmh/v
|
|
iyuKtTozFxmSATQP1w5VEWg=
|
|
=MWcN
|
|
-----END PGP SIGNATURE-----
|