-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2002-007 ================================= Topic: Repeated TIOCSCTTY ioctl can corrupt session hold counts Version: NetBSD-current: source prior to July 21, 2002 NetBSD-1.6 beta: source prior to July 23, 2002 NetBSD-1.5.*: source prior to September 5, 2002 NetBSD-1.5.3: affected NetBSD-1.5.2: affected NetBSD-1.5.1: affected NetBSD-1.5: affected NetBSD-1.4.*: affected Severity: Local user can cause system panic Fixed: NetBSD-current: July 21, 2002 NetBSD-1.6 branch: July 23, 2002 (1.6 includes the fix) NetBSD-1.5 branch: September 5, 2002 NetBSD-1.4 branch: not yet Abstract ======== A Session leader can use the TIOCSCTTY ioctl to set the session controlling terminal. This ioctl can be called any number of times. The call unconditionally raised the hold count of a kernel structure shared between processes in the same session. It was possible to overflow the structure counter, and thus arrange for the structure memory to be freed prematurely, and possibly re-used. This could cause a kernel panic or incorrect operation the next time the session structure is accessed from the context of other processes which are part of the former session. Technical Details ================= A process can start a new session (and thus create a new session leader), by forking a child and exiting. The new child can then call setsid(2) to create a new session, and thus become a session leader. The child process can then call the TIOCSCTTY ioctl. Structures shared between multiple processes (such as the session structure) normally contain counters to keep track of how many times a structure is referenced. Typically, macros are used to increase/decrease the use counter, and the structure is freed when the counter goes to zero. By repeatedly invoking TIOCSCTTY, it's possible to overflow the integer counter such that when a process exits (and thus the session structure counter is decreased), the counter hits zero and structure is freed even though other processes still reference it. Depending on kernel options, this might immediately cause the memory to be overwritten with junk data, or the memory will be overwritten by random other data when the memory is allocated to something else. In either case, if any of the processes of the old session group access the memory, they would very likely follow trashed pointers and cause a kernel panic. Solutions and Workarounds ========================= NetBSD official releases up to and including 1.5.3 are vulnerable. The recent NetBSD 1.6 release is not vulnerable to this issue. A full upgrade to NetBSD 1.6 is the recommended resolution for all users able to do so. Many security-related improvements have been made, and indeed this release has been delayed several times in order to include fixes for a number of recent issues. Otherwise, kernel sources must be updated and a new kernel built and installed. Once the kernel sources have been updated, rebuild the kernel, install it, and reboot. For more information on how to do this, see: http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel The instructions for updating your kernel sources depend upon which particular NetBSD release you are running. * NetBSD-current: Systems running NetBSD-current dated from before 2002-07-21 should be upgraded to NetBSD-current dated 2002-07-22 or later. The following directories need to be updated from the netbsd-current CVS branch (aka HEAD): src/sys/kern/ Alternatively, apply the following patch (with potential offset differences): ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch To patch: # cd src/sys # patch < /path/to/SA2002-007-tiocsctty.patch Configure, compile, install and boot a new kernel according to the instructions at: http://www.netbsd.org/Documentation/kernel/#building_a_kernel * NetBSD 1.6 beta: Systems running NetBSD 1.6 BETAs and Release Candidates should be upgraded to the NetBSD 1.6 release. If a source-based point upgrade is required, sources from the NetBSD-1.6 branch dated 2002-07-23 or later should be used. The following directories need to be updated from the netbsd-1-6 CVS branch: src/sys/kern/ Alternatively, apply the following patch (with potential offset differences): ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch To patch: # cd src/sys # patch < /path/to/SA2002-007-tiocsctty.patch Configure, compile, install and boot a new kernel according to the instructions at: http://www.netbsd.org/Documentation/kernel/#building_a_kernel * NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3: Systems running NetBSD 1.5.x dated from before 2002-09-05 should be upgraded to NetBSD-1.5 branch dated 2002-09-05 or later. The following directories need to be updated from the netbsd-1-5 CVS branch: src/sys/kern/ Alternatively, apply the following patch (with potential offset differences): ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch To patch: # cd src/sys # patch < /path/to/SA2002-007-tiocsctty.patch Configure, compile, install and boot a new kernel according to the instructions at: http://www.netbsd.org/Documentation/kernel/#building_a_kernel * NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3: The advisory will be updated to include instructions to remedy this problem for systems running the NetBSD-1.4 branch. Thanks To ========= David Laight, for finding the problem and original patches. Jaromir Dolecek, for fix and initial advisory text. The NetBSD Release Engineering teams, for great patience and assistance in dealing with repeated security issues discovered recently. Revision History ================ 2002-09-16 Initial release More Information ================ An up-to-date PGP signed copy of this release will be maintained at ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-007.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved. $NetBSD: NetBSD-SA2002-007.txt,v 1.13 2002/09/16 05:17:55 dan Exp $ -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBPYVp6T5Ru2/4N2IFAQFJlQQAyVqJqrdjewQrmRFSQb3HmwESQYe7mhtw Wc36bXxVYS35u3ctz3HL9soMfKoBxQfJhEWozAM6hTi6I0ISnX2mPVqTTBOmHENT 5AfhIJQmynx5yorVguEHp9E/zPvKo90lLKuz4KwAY6Fonzx/qT9YTk1DzJkYUrki umJi1sasvAU= =XDgt -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue Sep 17 2002 - 19:13:36 PDT