Full Disclosure mailing list archives
OpenBSD procfs
From: "Deprotect Advisories" <advisories () deprotect com>
Date: Mon, 17 May 2004 19:45:13 +0200
----------------------------------------------------------------------- Deprotect Security Advisory 20041405 ----------------------------------------------------------------------- Advisory ID : DEPROTECT-20041405 Authors : Christer Oberg, Joel Soderberg Publish date : 17/05/2004 Application : Procfs Version(s) : 3.5 (and earlier versions) Platforms : OpenBSD CVE# : Availability : http://www.deprotect.com/advisories/DEPROTECT-20041305.txt-----------------------------------------------------------------------
Problem: -----------------------------------------------------------------------Kernel memory disclosure via procfs.
Description: ----------------------------------------------------------------------- Several integer related bugs in the procfs code can lead to kernel memory disclosure. For example it is possible to trick procfs to return large chunks of kernel memory when reading the cmdline file of systemprocesses. This code is found in procfs_cmdline.c:
if (P_ZOMBIE(p) || (p->p_flag & P_SYSTEM) != 0) { len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm); xlen = len - uio->uio_offset; if (xlen <= 0) error = 0; else error = uiomove(arg, xlen, uio); free(arg, M_TEMP); return (error);}
It is trivial to for example pread() the descriptor with an offset and have it return more data than it should. There are other examples ofsimilar bugs in the procfs code.
Workaround: -----------------------------------------------------------------------Unmount procfs.
Fix: -----------------------------------------------------------------------Patch available at http://www.openbsd.org/errata.html
Disclosure Timeline:-----------------------------------------------------------------------
03/05/2004: Initial email to vendor. 13/05/2004: Patch made available (without telling us) About Deprotect: ----------------------------------------------------------------------- Deprotect is a Swedish based security company divided into four divisions; Managed Security Services, Security Services, Products and Development andour Security Academy. Deprotect - When security is first priority
Contacting Deprotect: ----------------------------------------------------------------------- E-mail: advisories(-at-)deprotect.com or info(-at-)deprotect.com Homepage: http://www.deprotect.com/Phone: +46-530-444 60
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- OpenBSD procfs Deprotect Advisories (May 17)
- Re: OpenBSD procfs Ted Unangst (May 17)