3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
93 lines
3.2 KiB
Text
93 lines
3.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:37.kqueue Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: local users can panic the system using the kqueue mechanism
|
|
|
|
Category: core
|
|
Module: kqueue
|
|
Announced: 2002-08-05
|
|
Credits: Mark Delany <markd@bushwire.net>
|
|
Affects: FreeBSD 4.3-RELEASE
|
|
FreeBSD 4.4-RELEASE
|
|
FreeBSD 4.5-RELEASE
|
|
FreeBSD 4.6-RELEASE
|
|
FreeBSD 4.6-STABLE prior to the correction date
|
|
Corrected: 2002-08-05 15:05:15 (RELENG_4)
|
|
2002-08-05 15:13:48 (RELENG_4_6)
|
|
2002-08-05 15:13:44 (RELENG_4_5)
|
|
2002-08-05 15:13:40 (RELENG_4_4)
|
|
FreeBSD only: YES
|
|
|
|
I. Background
|
|
|
|
The kqueue mechanism allows a process to register interest in
|
|
particular events on particular file descriptors, and receive
|
|
asynchronous notification when these events occur on the selected
|
|
descriptors.
|
|
|
|
II. Problem Description
|
|
|
|
If a pipe was created with the pipe(2) system call, and one end of the
|
|
pipe was closed, registering an EVFILT_WRITE filter on the other end
|
|
would cause a kernel panic.
|
|
|
|
A common scenario in which this could occur is when a process uses a
|
|
pipe to communicate with a child and uses kqueue to monitor the pipe,
|
|
and the child dies shortly after the fork(2) call, before the parent
|
|
has had time to register the filter.
|
|
|
|
III. Impact
|
|
|
|
A local attacker may cause the system to panic by executing their own
|
|
malicious application.
|
|
|
|
IV. Workaround
|
|
|
|
There is no known workaround.
|
|
|
|
V. Solution
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.4, 4.5, and
|
|
4.6 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:37/kqueue.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:37/kqueue.patch.asc
|
|
|
|
b) Apply the patch.
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
sys/kern/sys_pipe.c
|
|
RELENG_4 1.60.2.13
|
|
RELENG_4_6 1.60.2.12.2.1
|
|
RELENG_4_5 1.60.2.11.2.1
|
|
RELENG_4_4 1.60.2.10.2.1
|
|
- -------------------------------------------------------------------------
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.7 (FreeBSD)
|
|
|
|
iQCVAwUBPU8OFlUuHi5z0oilAQFTugP/S+2u/BK8Oz53oFTcTY84ReNRJZMEJ8dX
|
|
PVHMWZ7xl4stYoeo8iX+moq+R2riZqEfzT+lx1lYZBkYkkmIwGxI+6qJgBqkPriL
|
|
acswOhfdzLSgwIoXNJsGdO9vlYwsNqiRsf5Yay+gKDqRUxCPA27X528uc1jhtAdd
|
|
UzagA6Lhrk8=
|
|
=uTZC
|
|
-----END PGP SIGNATURE-----
|