SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   NetBSD Vendors:   NetBSD
NetBSD Kernel TIOCSCTTY I/O Control Counter Overflow Lets Local Users Crash the System
SecurityTracker Alert ID:  1005229
SecurityTracker URL:  http://securitytracker.com/id/1005229
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 17 2002
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.6 beta, 1.5, 1.4
Description:   A denial of service vulnerability was reported in the NetBSD operating system kernel. A local user can cause a system panic.

It is reported that a local user can call the TIOCSCTTY ioctl repeatedly to cause a kernel structure counter to overflow and prematurely free memory. This could cause a kernel panic or incorrect operating system operation.

A counter used to track the number of times a particular shared structure is accessed could be made to overflow. Then, when a process exits and the session structure counter is decreased, the counter will reach zero causing the kernel to free the structure, even though there may be processes that still reference the structure. As a result, the freeded memory may be overwritten with 'junk data' or random data. If a process that still references the structure tries to access the memory, a kernel panic would be triggered.

NetBSD official releases up to and including 1.5.3 are vulnerable.

Impact:   A local user could cause a kernel panic.
Solution:   The vendor has released a fixed version of NetBSD (1.6 release). A full upgrade to NetBSD 1.6 is the recommended resolution for all users able to do so.

Otherwise, kernel sources must be updated and a new kernel built and installed. Once the kernel sources have been updated, rebuild the kernel, install it, and reboot. For more information on how to do this, see:

http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel

The instructions for updating your kernel sources depend upon which particular NetBSD release you are running.

* NetBSD-current:

Systems running NetBSD-current dated from before 2002-07-21 should be upgraded to NetBSD-current dated 2002-07-22 or later.

The following directories need to be updated from the netbsd-current CVS branch (aka HEAD):
src/sys/kern/

Alternatively, apply the following patch (with potential offset differences):

ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch

Configure, compile, install and boot a new kernel according to the instructions at:
http://www.netbsd.org/Documentation/kernel/#building_a_kernel


* NetBSD 1.6 beta:

Systems running NetBSD 1.6 BETAs and Release Candidates should be upgraded to the NetBSD 1.6 release.

If a source-based point upgrade is required, sources from the NetBSD-1.6 branch dated 2002-07-23 or later should be used.

The following directories need to be updated from the netbsd-1-6 CVS branch:
src/sys/kern/

Alternatively, apply the following patch (with potential offset differences):

ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch

Configure, compile, install and boot a new kernel according to the instructions at:

http://www.netbsd.org/Documentation/kernel/#building_a_kernel


* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

Systems running NetBSD 1.5.x dated from before 2002-09-05 should be upgraded to NetBSD-1.5 branch dated 2002-09-05 or later.

The following directories need to be updated from the netbsd-1-5 CVS branch:
src/sys/kern/

Alternatively, apply the following patch (with potential offset differences):

ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch

Configure, compile, install and boot a new kernel according to the instructions at:

http://www.netbsd.org/Documentation/kernel/#building_a_kernel


The vendor has not yet released a fix for NetBSD 1.4, 1.4.1, 1.4.2, or 1.4.3.

Vendor URL:  www.NetBSD.ORG/Security/ (Links to External Site)
Cause:   Boundary error, State error
Underlying OS:  UNIX (NetBSD)

Message History:   None.


 Source Message Contents

Subject:  NetBSD Security Advisory 2002-007: Repeated TIOCSCTTY ioctl can corrupt session hold counts



-----BEGIN PGP SIGNED MESSAGE-----


		 NetBSD Security Advisory 2002-007
		 =================================

Topic:		Repeated TIOCSCTTY ioctl can corrupt session hold counts

Version:	NetBSD-current:	source prior to July 21, 2002 
		NetBSD-1.6 beta: source prior to July 23, 2002
		NetBSD-1.5.*:	source prior to September 5, 2002
		NetBSD-1.5.3:	affected
		NetBSD-1.5.2:	affected
		NetBSD-1.5.1:	affected
		NetBSD-1.5:	affected
		NetBSD-1.4.*:	affected

Severity:	Local user can cause system panic

Fixed:		NetBSD-current:		July 21, 2002
		NetBSD-1.6 branch:	July 23, 2002 (1.6 includes the fix)
		NetBSD-1.5 branch:	September 5, 2002
		NetBSD-1.4 branch:	not yet


Abstract
========

A Session leader can use the TIOCSCTTY ioctl to set the session
controlling terminal. This ioctl can be called any number of times.
The call unconditionally raised the hold count of a kernel structure
shared between processes in the same session. It was possible to
overflow the structure counter, and thus arrange for the structure
memory to be freed prematurely, and possibly re-used.  This could
cause a kernel panic or incorrect operation the next time the session
structure is accessed from the context of other processes which are
part of the former session.

Technical Details
=================

A process can start a new session (and thus create a new session
leader), by forking a child and exiting. The new child can then call
setsid(2) to create a new session, and thus become a session
leader. The child process can then call the TIOCSCTTY ioctl.

Structures shared between multiple processes (such as the session
structure) normally contain counters to keep track of how many times a
structure is referenced. Typically, macros are used to increase/decrease
the use counter, and the structure is freed when the counter goes to
zero.

By repeatedly invoking TIOCSCTTY, it's possible to overflow the integer
counter such that when a process exits (and thus the session structure
counter is decreased), the counter hits zero and structure is freed even
though other processes still reference it. Depending on kernel options,
this might immediately cause the memory to be overwritten with junk
data, or the memory will be overwritten by random other data when the
memory is allocated to something else. In either case, if any of the
processes of the old session group access the memory, they would very
likely follow trashed pointers and cause a kernel panic.

Solutions and Workarounds
=========================

NetBSD official releases up to and including 1.5.3 are vulnerable.

The recent NetBSD 1.6 release is not vulnerable to this issue. A full
upgrade to NetBSD 1.6 is the recommended resolution for all users able
to do so. Many security-related improvements have been made, and
indeed this release has been delayed several times in order to include
fixes for a number of recent issues.

Otherwise, kernel sources must be updated and a new kernel built and
installed.  Once the kernel sources have been updated, rebuild the
kernel, install it, and reboot.  For more information on how to do
this, see:
  http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel

The instructions for updating your kernel sources depend upon which
particular NetBSD release you are running.

* NetBSD-current:

	Systems running NetBSD-current dated from before 2002-07-21
	should be upgraded to NetBSD-current dated 2002-07-22 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):
		src/sys/kern/

	Alternatively, apply the following patch (with potential offset
	differences):
 ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

	To patch:
		# cd src/sys
		# patch < /path/to/SA2002-007-tiocsctty.patch
	
	Configure, compile, install and boot a new kernel according to
	the instructions at:
	    http://www.netbsd.org/Documentation/kernel/#building_a_kernel 


* NetBSD 1.6 beta:

	Systems running NetBSD 1.6 BETAs and Release Candidates should
	be upgraded to the NetBSD 1.6 release.

	If a source-based point upgrade is required, sources from the
	NetBSD-1.6 branch dated 2002-07-23 or later should be used.

	The following directories need to be updated from the
	netbsd-1-6 CVS branch:
		src/sys/kern/

	Alternatively, apply the following patch (with potential offset
	differences):
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

	To patch:
		# cd src/sys
		# patch < /path/to/SA2002-007-tiocsctty.patch
	
	Configure, compile, install and boot a new kernel according to
	the instructions at:
	    http://www.netbsd.org/Documentation/kernel/#building_a_kernel 


* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

	Systems running NetBSD 1.5.x dated from before 2002-09-05
	should be upgraded to NetBSD-1.5 branch dated 2002-09-05 or later.

	The following directories need to be updated from the
	netbsd-1-5 CVS branch:
		src/sys/kern/

	Alternatively, apply the following patch (with potential offset
	differences):
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch

	To patch:
		# cd src/sys
		# patch < /path/to/SA2002-007-tiocsctty.patch

	Configure, compile, install and boot a new kernel according to
	the instructions at:
	    http://www.netbsd.org/Documentation/kernel/#building_a_kernel 


* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

	The advisory will be updated to include instructions to remedy
	this problem for systems running the NetBSD-1.4 branch.


Thanks To
=========

David Laight, for finding the problem and original patches.

Jaromir Dolecek, for fix and initial advisory text.

The NetBSD Release Engineering teams, for great patience and
assistance in dealing with repeated security issues discovered
recently.


Revision History
================

	2002-09-16	Initial release


More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-007.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2002, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2002-007.txt,v 1.13 2002/09/16 05:17:55 dan Exp $


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPYVp6T5Ru2/4N2IFAQFJlQQAyVqJqrdjewQrmRFSQb3HmwESQYe7mhtw
Wc36bXxVYS35u3ctz3HL9soMfKoBxQfJhEWozAM6hTi6I0ISnX2mPVqTTBOmHENT
5AfhIJQmynx5yorVguEHp9E/zPvKo90lLKuz4KwAY6Fonzx/qT9YTk1DzJkYUrki
umJi1sasvAU=
=XDgt
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC