3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
127 lines
4.1 KiB
Text
127 lines
4.1 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-98:05 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: system crash with NFS
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 1998-06-04
|
|
Affects: FreeBSD 2.2.* and FreeBSD-stable before 1998/05/31
|
|
this problem.
|
|
Corrected: FreeBSD-current as of 1998/05/31
|
|
FreeBSD only: no (also other 4.4BSD based systems may be affected)
|
|
|
|
Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-98:05/
|
|
|
|
=============================================================================
|
|
IMPORTANT MESSAGE: The FreeBSD security officer now uses the policy
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/POLICY.asc for sending out advisories.
|
|
=============================================================================
|
|
|
|
I. Background
|
|
|
|
NFS can be used to mount remote file systems. Apart from being
|
|
remote, it acts like a normal UFS file system. Among others,
|
|
This means that creating hard links can be done in NFS
|
|
file systems
|
|
|
|
II. Problem Description
|
|
|
|
When creating hard links on file systems, the kernel checks that
|
|
both the original file and the link to it are located on the same
|
|
file system. Unfortunately, there is an error in the NFS kernel code
|
|
in FreeBSD 2.2.* systems that performs this check.
|
|
|
|
III. Impact
|
|
|
|
It is possible to crash a FreeBSD 2.2.* system by hard linking
|
|
a device special files to a file on an NFS mounted file system.
|
|
|
|
FreeBSD-current is not vulnerable.
|
|
|
|
IV. Workaround
|
|
|
|
No real work around is known (except for unmounting your NFS
|
|
file systems).
|
|
|
|
V. Solution
|
|
|
|
Apply one of the following patches, rebuild your kernel,
|
|
install it and reboot your system.
|
|
|
|
The patches below can be found on
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-98:05/
|
|
|
|
|
|
Patch for 2.2.5 and 2.2.6 systems:
|
|
|
|
|
|
Index: nfs_vnops.c
|
|
===================================================================
|
|
RCS file: /home/cvsup/freebsd/CVS/src/sys/nfs/nfs_vnops.c,v
|
|
retrieving revision 1.36.2.6
|
|
retrieving revision 1.36.2.7
|
|
diff -u -r1.36.2.6 -r1.36.2.7
|
|
--- nfs_vnops.c 1998/05/13 05:48:45 1.36.2.6
|
|
+++ nfs_vnops.c 1998/05/31 00:07:29 1.36.2.7
|
|
@@ -1755,17 +1755,8 @@
|
|
struct componentname *a_cnp;
|
|
} */ *ap;
|
|
{
|
|
-#if defined(__NetBSD__)
|
|
- /*
|
|
- * Since the args are reversed in the VOP_LINK() calls,
|
|
- * switch them back. Argh!
|
|
- */
|
|
- register struct vnode *vp = ap->a_tdvp;
|
|
- register struct vnode *tdvp = ap->a_vp;
|
|
-#else
|
|
register struct vnode *vp = ap->a_vp;
|
|
register struct vnode *tdvp = ap->a_tdvp;
|
|
-#endif
|
|
register struct componentname *cnp = ap->a_cnp;
|
|
register u_long *tl;
|
|
register caddr_t cp;
|
|
@@ -1776,11 +1767,8 @@
|
|
int v3 = NFS_ISV3(vp);
|
|
|
|
if (vp->v_mount != tdvp->v_mount) {
|
|
- VOP_ABORTOP(vp, cnp);
|
|
- if (tdvp == vp)
|
|
- vrele(tdvp);
|
|
- else
|
|
- vput(tdvp);
|
|
+ VOP_ABORTOP(tdvp, cnp);
|
|
+ vput(tdvp);
|
|
return (EXDEV);
|
|
}
|
|
|
|
|
|
=============================================================================
|
|
FreeBSD, Inc.
|
|
|
|
Web Site: http://www.freebsd.org/
|
|
Confidential contacts: security-officer@freebsd.org
|
|
Security notifications: security-notifications@freebsd.org
|
|
Security public discussion: freebsd-security@freebsd.org
|
|
PGP Key: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc
|
|
|
|
Notice: Any patches in this document may not apply cleanly due to
|
|
modifications caused by digital signature or mailer software.
|
|
Please reference the URL listed at the top of this document
|
|
for original copies of all patches if necessary.
|
|
=============================================================================
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.3ia
|
|
Charset: noconv
|
|
|
|
iQCVAwUBNXbehFUuHi5z0oilAQHS8gQAgIgUrioo3hT+mJLyxUp//ASoFPSf2+vw
|
|
fmq2D9qEYyV5Od/HLBnzgb3jz5xyqWDLBx6pNV3QIPAimw3+S0oHOUYG+UCn96yD
|
|
58kEx6mc8KanEHs0lzdgoqFi6ioVkPzCplxzqy+QfQvDCJPE+w7BbFkwVXhJHNof
|
|
4JvVbewoA9c=
|
|
=ILgB
|
|
-----END PGP SIGNATURE-----
|