dd97bfc0fc
Fix NFS server deadlock vulnerability. [SA-14:05] Fix OpenSSL multiple vulnerabilities. [SA-14:06]
165 lines
6.2 KiB
Text
165 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:05.nfsserver Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Deadlock in the NFS server
|
|
|
|
Category: core
|
|
Module: nfsserver
|
|
Announced: 2014-04-08
|
|
Credits: Rick Macklem
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2014-04-08 18:27:39 UTC (stable/10, 10.0-STABLE)
|
|
2014-04-08 18:27:46 UTC (releng/10.0, 10.0-RELEASE-p1)
|
|
2014-04-08 23:16:19 UTC (stable/9, 9.2-STABLE)
|
|
2014-04-08 23:16:05 UTC (releng/9.2, 9.2-RELEASE-p4)
|
|
2014-04-08 23:16:05 UTC (releng/9.1, 9.1-RELEASE-p11)
|
|
2014-04-08 23:16:19 UTC (stable/8, 8.4-STABLE)
|
|
2014-04-08 23:16:05 UTC (releng/8.4, 8.4-RELEASE-p8)
|
|
2014-04-08 23:16:05 UTC (releng/8.3, 8.3-RELEASE-p15)
|
|
CVE Name: CVE-2014-1453
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The Network File System (NFS) allows a host to export some or all of its
|
|
file systems so that other hosts can access them over the network and mount
|
|
them as if they were on local disks. FreeBSD includes both server and client
|
|
implementations of NFS.
|
|
|
|
II. Problem Description
|
|
|
|
The kernel holds a lock over the source directory vnode while trying to
|
|
convert the target directory file handle to a vnode, which needs to be
|
|
returned with the lock held, too. This order may be in violation of normal
|
|
lock order, which in conjunction with other threads that grab locks in the
|
|
right order, constitutes a deadlock condition because no thread can proceed.
|
|
|
|
III. Impact
|
|
|
|
An attacker on a trusted client could cause the NFS server become deadlocked,
|
|
resulting in a denial of service.
|
|
|
|
IV. Workaround
|
|
|
|
Systems that do not provide NFS services are not vulnerable. Neither
|
|
are systems that do but use the old NFS implementation, which is the
|
|
default in FreeBSD 8.x.
|
|
|
|
To determine which implementation an NFS server is running, run the
|
|
following command:
|
|
|
|
# kldstat -v | grep -cw nfsd
|
|
|
|
This will print 1 if the system is running the new NFS implementation,
|
|
and 0 otherwise.
|
|
|
|
To switch to the old NFS implementation:
|
|
|
|
1) Append the following lines to /etc/rc.conf:
|
|
|
|
nfsv4_server_enable="no"
|
|
oldnfs_server_enable="yes"
|
|
|
|
2) If the NFS server is compiled into the kernel (which is the case
|
|
for the stock GENERIC kernel), replace the NFSD option with the
|
|
NFSSERVER option, then recompile your kernel as described in
|
|
<URL:http://www.FreeBSD.org/handbook/kernelconfig.html>.
|
|
|
|
If the NFS server is not compiled into the kernel, the correct
|
|
module will be loaded at boot time.
|
|
|
|
3) Finally, reboot the system.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:05/nfsserver.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:05/nfsserver.patch.asc
|
|
# gpg --verify nfsserver.patch.asc
|
|
|
|
b) Apply the patch.
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
3) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r264285
|
|
releng/8.3/ r264284
|
|
releng/8.4/ r264284
|
|
stable/9/ r264285
|
|
releng/9.1/ r264284
|
|
releng/9.2/ r264284
|
|
stable/10/ r264266
|
|
releng/10.0/ r264267
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1453>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:05.nfsserver.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0.22 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJTRISyAAoJEO1n7NZdz2rnOvoQAJoxWjKV1UACccAi4Z/ChESU
|
|
rSi2NrW6ZixCmSzbPxAcz9Qv7vaQVSywfG5Zy1JddNh1aVy4ExUsd/FZcRr92Cz2
|
|
ujprve/JBMc0YOsND7KIna9Rk7Ryj0IchRXquN5SyDhZbvWwnDNatQWID5awzgYM
|
|
aX+48WUFk/oFX009JCR2LO3u3GqOZN6fJhLSQs+Yj+CuxQO9XlQSSUK+lTDO/2ig
|
|
snT7j52eCJhsMNn1QcdMGx1Y+NdfIEDfinioAPKLUfWCXWwNRAhTD5scasHDQWV4
|
|
60kVXZzl/CNOD7awOXwIrx3GRPQSwsg2YUqGP+jXlEdIA+MNE5+vUijDcLI/cTBj
|
|
WSApShrdybIyOyPzczDKmLae9NUeKspUoZTwwwSJ6p8Zr6m0/dBzKbk7TB+XFn17
|
|
Q1FVDkpq7pJUzPQxNfB9Z6wwRXeZgaJBEck/P0DvHZwJDq1mZLbcPFap91I4p471
|
|
iBVhSHHP466pj0EUuCjNrld7BgVj/iCrCO7LZr4L9t/7sDAIE+CYqv5eR7byUIOO
|
|
WoMs3zplSR1XgTk5c9p6XQifv3dtRGyJicfjtKdNFxYjeokIhXxdAjWjQmwC2XoG
|
|
PK7enzV2MHWg3nCpdCztD+4ZjHqdwOq/o2g0rVrum7SfOeZXyqr+YB58rpd6uR11
|
|
8z8hxDfKCzc/Lo1/T+EO
|
|
=xBcd
|
|
-----END PGP SIGNATURE-----
|