3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
152 lines
5.5 KiB
Text
152 lines
5.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-10:03.zfs Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: ZFS ZIL playback with insecure permissions
|
|
|
|
Category: contrib
|
|
Module: zfs
|
|
Announced: 2010-01-06
|
|
Credits: Pawel Jakub Dawidek
|
|
Affects: FreeBSD 7.0 and later.
|
|
Corrected: 2009-11-14 11:59:59 UTC (RELENG_8, 8.0-STABLE)
|
|
2010-01-06 21:45:30 UTC (RELENG_8_0, 8.0-RELEASE-p2)
|
|
2010-01-06 21:45:30 UTC (RELENG_7, 7.2-STABLE)
|
|
2010-01-06 21:45:30 UTC (RELENG_7_2, 7.2-RELEASE-p6)
|
|
2010-01-06 21:45:30 UTC (RELENG_7_1, 7.1-RELEASE-p10)
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
ZFS is a file-system originally developed by Sun Microsystems.
|
|
|
|
The ZFS Intent Log ("ZIL") is a mechanism that gathers together in memory
|
|
transactions of writes, and is flushed onto disk when synchronous
|
|
semantics is necessary. In the event of crash or power failure, the
|
|
log is examined and the uncommitted transaction would be replayed to
|
|
maintain the synchronous semantics.
|
|
|
|
II. Problem Description
|
|
|
|
When replaying setattr transaction, the replay code would set the
|
|
attributes with certain insecure defaults, when the logged
|
|
transaction did not touch these attributes.
|
|
|
|
III. Impact
|
|
|
|
A system crash or power fail would leave some file with mode set
|
|
to 07777. This could leak sensitive information or cause privilege
|
|
escalation.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems not using ZFS are not
|
|
vulnerable.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to the
|
|
RELENG_8_0, RELENG_7_2, or RELENG_7_1 security branch dated after the
|
|
correction date.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patches have been verified to apply to FreeBSD 7.1, 7.2,
|
|
and 8.0 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 7.x]
|
|
# fetch http://security.FreeBSD.org/patches/SA-10:03/zfs712.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-10:03/zfs712.patch.asc
|
|
|
|
[FreeBSD 8.0]
|
|
# fetch http://security.FreeBSD.org/patches/SA-10:03/zfs.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-10:03/zfs.patch.asc
|
|
|
|
b) Apply the patch.
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
3) Examine the system and look for affected files.
|
|
|
|
These files can be identified with the following command:
|
|
|
|
# find / -perm -7777 -print0 | xargs -0 ls -ld
|
|
|
|
The system administrator will have to correct these problems if there
|
|
is any files with such permission modes. For example:
|
|
|
|
# find / -perm -7777 -print0 | xargs -0 chmod u=rwx,go=
|
|
|
|
Will reset access mode bits to be readable, writable and executable
|
|
by the owner only. The system administrator should determine the
|
|
appropriate mode bits wisely.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
CVS:
|
|
|
|
Branch Revision
|
|
Path
|
|
- -------------------------------------------------------------------------
|
|
RELENG_7
|
|
src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c 1.6.2.3
|
|
RELENG_7_2
|
|
src/UPDATING 1.507.2.23.2.9
|
|
src/sys/conf/newvers.sh 1.72.2.11.2.10
|
|
src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
|
|
1.6.2.1.4.1
|
|
RELENG_7_1
|
|
src/UPDATING 1.507.2.13.2.13
|
|
src/sys/conf/newvers.sh 1.72.2.9.2.14
|
|
src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
|
|
1.6.2.1.2.1
|
|
RELENG_8
|
|
src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c 1.8.2.2
|
|
RELENG_8_0
|
|
src/UPDATING 1.632.2.7.2.5
|
|
src/sys/conf/newvers.sh 1.83.2.6.2.5
|
|
src/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c 1.8.4.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
Subversion:
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/7/ r201679
|
|
releng/7.2/ r201679
|
|
releng/7.1/ r201679
|
|
stable/8/ r199266
|
|
releng/8.0/ r201679
|
|
head/ r199157
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
The latest revision of this advisory is available at
|
|
http://security.FreeBSD.org/advisories/FreeBSD-SA-10:03.zfs.asc
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.4.10 (FreeBSD)
|
|
|
|
iD8DBQFLRRILFdaIBMps37IRAnI3AJ9ioK1Bbg++DpPYW/RX9wnujAeJxACff+Ph
|
|
oEIfaiJ5y/DoGhklcAJdXTU=
|
|
=JPje
|
|
-----END PGP SIGNATURE-----
|