Bugtraq mailing list archives
NetBSD Security Advisory 1999-012
From: security-officer () NETBSD ORG (Daniel Carosone)
Date: Wed, 16 Feb 2000 07:58:57 +1100
-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 1999-012 ================================= Topic: ptrace(2)'d processes can gain "kernel" privileges on vax. Version: NetBSD/vax 1.4.1 and earlier; -current prior to 19991212 Severity: Theoretical problem only, no known exploits Abstract ======== As part of an ongoing effort to construct a secure kernel and application environment, the NetBSD project has identified and corrected a possible security issue. A wrapper program can be constructed by a local user that can modify the hardware privileges of a ptrace(2)'d process. It might be possible to write a security-related exploit via this mechanism. Technical Details ================= NetBSD uses the ptrace(2) system call to trace and debug other processes. The debugging process can also modify the internal registers, including the status (PSL) register, for the process being debugged. Besides the normal user-accessible flags, the VAX hardware also stores information about privilege levels and used stacks in the PSL. Those flags are only altered via the instruction REI (return from interrupt) or LDPCTX (load process context) and cannot be modified while running in "user" mode. When the PSL contents are altered by the debugging process, the debugged process is in the kernel, and will get the privileges defined by the PSL when it REI to userspace to continue execution. Solutions and Workarounds ========================= Upgrade to NetBSD-current, or apply the following patch to 1.4.1: Index: machdep.c =================================================================== RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v retrieving revision 1.76.2.1 diff -c -r1.76.2.1 machdep.c *** machdep.c 1999/04/16 16:26:01 1.76.2.1 - --- machdep.c 1999/12/12 11:08:46 *************** *** 770,776 **** tf->fp = regs->fp; tf->sp = regs->sp; tf->pc = regs->pc; ! tf->psl = regs->psl; return 0; } - --- 770,777 ---- tf->fp = regs->fp; tf->sp = regs->sp; tf->pc = regs->pc; ! tf->psl = (regs->psl|PSL_U|PSL_PREVU) & ! ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */ return 0; } Thanks To ========= Discovery of the problem by Klaus Klein (kleink () netbsd org) Revision History ================ 1999/12/12 - initial version More Information ================ Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 1999, The NetBSD Foundation, Inc. All Rights Reserved. $NetBSD: NetBSD-SA1999-012.txt,v 1.3 2000/02/15 13:33:47 dan Exp $ -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBOKlXcD5Ru2/4N2IFAQEvPAP+IXJ+48+eC/iDXTDXTG4QLNsqBZT4QRki Y6DI7j0NqioiEvuJScW54dVpL0rUOd7XJH5bI27q2XEBy2J9furOwjFDb3Y4gpoU 4GWyQyw1oCd3tGecfUETlFtBdPNM6qVObEeKeQr87kbUsugSZUW+RuY4OA6Lywf7 rTMlmyoYuss= =xqwx -----END PGP SIGNATURE-----
Current thread:
- Re: Packet Tracing (linux klog patch), (continued)
- Re: Packet Tracing (linux klog patch) Andrzej Bialecki (Feb 15)
- Re: Packet Tracing (linux klog patch) Dragos Ruiu (Feb 17)
- Re: Packet Tracing (linux klog patch) Andrzej Bialecki (Feb 17)
- crash windows boxes on your local network (twinge.c) sinkhole () NILL NET (Feb 10)
- Re: crash windows boxes on your local network (twinge.c) Elias Levy (Feb 14)
- DDOS Attack Mitigation Elias Levy (Feb 11)
- TESO - Nameserver traffic amplify and NS route discovery Sebastian (Feb 12)
- Re: DDOS Attack Mitigation Darren Reed (Feb 13)
- Re: DDOS Attack Mitigation Alan Brown (Feb 14)
- Re: DDOS Attack Mitigation Darren Reed (Feb 14)
- NetBSD Security Advisory 1999-012 Daniel Carosone (Feb 15)
- Re: DDOS Attack Mitigation Chris Cappuccio (Feb 15)
- Re: DDOS Attack Mitigation Carson Gaspar (Feb 15)
- Re: DDOS Attack Mitigation John Edwards (Feb 15)
- Re: DDOS Attack Mitigation Ryan Russell (Feb 16)
- Administrivia Elias Levy (Feb 16)
- Re: DDOS Attack Mitigation John Payne (Feb 14)
- Re: DDOS Attack Mitigation Julien Nadeau (Feb 14)
- Re: DDOS Attack Mitigation Bennett Todd (Feb 15)
- rp_filter? (was Re: DDOS Attack Mitigation) Julien Nadeau (Feb 18)
- Re: DDOS Attack Mitigation Homer Wilson Smith (Feb 14)