Security Advisories
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
Subject: FreeBSD Security Advisory FreeBSD-SA-02:09.fstatfs
From: FreeBSD Security Advisories <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Date: Wed, 6 Feb 2002 08:03:40 -0800 (PST)
-----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
FreeBSD-SA-02:09 Security Advisory
FreeBSD, Inc.
Topic: fstatfs race condition may allow local denial of
service via procfs
Category: core
Module: kernel
Announced: 2002-02-06
Credits: Stefan Esser <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Affects: All released versions of FreeBSD prior to 4.5-RELEASE
Corrected: 2002-01-07 20:47:34 UTC (RELENG_4)
2002-01-17 15:46:46 UTC (RELENG_4_4)
2002-01-17 15:47:04 UTC (RELENG_4_3)
FreeBSD only: YES
I. Background
fstatfs() is a function that retrieves filesystem statistics in the
kernel. procfs is the process filesystem, which presents a filesystem
interface to the system process table and associated data.
II. Problem Description
A race condition existed where a file could be removed between calling
fstatfs() and the point where the file is accessed causing the file
descriptor to become invalid. This may allow unprivileged local users
to cause a kernel panic. Currently only the procfs filesystem is
known to be vulnerable.
III. Impact
On vulnerable FreeBSD systems where procfs is mounted, unprivileged
local users may be able to cause a kernel panic.
IV. Workaround
Unmount all instances of the procfs filesystem using the umount(8)
command by performing the following as root:
# umount -f -a -t procfs
Disable the automatic mounting of all instances of procfs in
/etc/fstab, remove or comment out the line(s) of the following form:
proc /proc procfs rw 0 0
Note that unmounting procfs may have a negative impact on the
operation of the system: under older versions of FreeBSD it is
required for some aspects of the ps(1) command, and unmounting it may
also break use of userland inter-process debuggers such as gdb. Other
installed binaries including emulated Linux binaries may require access
to procfs for correct operation.
V. Solution
1) Upgrade your vulnerable FreeBSD system to 4.5-RELEASE or
4.5-STABLE, or the RELENG_4_5, RELENG_4_4, or RELENG_4_3 security
branches dated after their respective correction dates.
2) FreeBSD 4.x systems prior to the correction date:
The following patch has been verified to apply to all FreeBSD 4.x
releases dated prior to the correction date. This patch may or may
not apply to older, unsupported releases of FreeBSD.
Download the patch and the detached PGP signature from the following
locations, and verify the signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch.asc
Execute the following commands as root:
# cd /usr/src
# patch -p < /path/to/patch
If procfs is statically compiled into the kernel (i.e. the kernel
configuration file contains the line 'options PROCFS'), rebuild
and reinstall your kernel as described in
http://www.freebsd.org/handbook/kernelconfig.html and reboot the
system with the new kernel for the changes to take effect.
If procfs is dynamically loaded by KLD (use the kldstat command to
verify whether this is the case) and the system securelevel has not
been raised, the system can be patched at run-time without
requiring a reboot by the execution of the following commands after
patching the source as described above:
# cd /usr/src/sys/modules/procfs
# make depend && make all install
# umount -f -a -t procfs
# kldunload procfs
# kldload procfs
# mount -a -t procfs
VI. Correction details
The following list contains the $FreeBSD$ revision numbers of the
file that was corrected in the FreeBSD source.
Path Revision
Branch
- -------------------------------------------------------------------------
src/sys/kern/vfs_syscalls.c
HEAD 1.216
RELENG_4 1.151.2.13
RELENG_4_4 1.151.2.9.2.1
RELENG_4_3 1.151.2.7.2.1
- -------------------------------------------------------------------------
VII. References
<URL:http://www.FreeBSD.org/cgi/query-pr.cgi?pr=32681>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBPGFTc1UuHi5z0oilAQGoMgP/REVJNr2Y+khbQAVX1VM+bnySdGxFKDVS
0niQ7ZrnI/Ffs7Kw0Nf5T82kvL2gFKRKPW1F2bl+A3qwDO2CBq/mKWLPuP+Ha/Id
oLtLeE446o/Gv6wdYpKzcdzUtPFcAhaPdD8DxSmdXyVjXuIYXgojM4wPgQcf5PVL
YW7uAAQ2cM0=
=T2JK
-----END PGP SIGNATURE-----
To Unsubscribe: send mail to This email address is being protected from spambots. You need JavaScript enabled to view it.
with "unsubscribe freebsd-security-notifications" in the body of the message
| Powered by: | MHonArc  |
