[Full-Disclosure] OpenBSD procfs

From: Deprotect Advisories (advisories_at_deprotect.com)
Date: 05/17/04

  • Next message: Janek Vind: "[Full-Disclosure] [waraxe-2004-SA#030 - Multiple vulnerabilities in PhpNuke 6.x - 7.3]" 
    To: full-disclosure@lists.netsys.com
Date: Mon, 17 May 2004 19:45:13 +0200

     -----------------------------------------------------------------------
    Deprotect Security Advisory 20041405
     -----------------------------------------------------------------------
    Advisory ID : DEPROTECT-20041405
    Authors : Christer Oberg, Joel Soderberg
    Publish date : 17/05/2004
    Application : Procfs
    Version(s) : 3.5 (and earlier versions)
    Platforms : OpenBSD
    CVE# :
    Availability : http://www.deprotect.com/advisories/DEPROTECT-20041305.txt
     -----------------------------------------------------------------------

    Problem:
     -----------------------------------------------------------------------
    Kernel memory disclosure via procfs.

    Description:
     -----------------------------------------------------------------------
    Several integer related bugs in the procfs code can lead to kernel
    memory disclosure. For example it is possible to trick procfs to return
    large chunks of kernel memory when reading the cmdline file of system
    processes.

    This code is found in procfs_cmdline.c:

            if (P_ZOMBIE(p) || (p->p_flag & P_SYSTEM) != 0) {
                   len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm);
                   xlen = len - uio->uio_offset;
                   if (xlen <= 0)
                           error = 0;
                   else
                           error = uiomove(arg, xlen, uio);
                    free(arg, M_TEMP);
                   return (error);
            }

    It is trivial to for example pread() the descriptor with an offset and
    have it return more data than it should. There are other examples of
    similar bugs in the procfs code.

     

    Workaround:
     -----------------------------------------------------------------------
    Unmount procfs.

    Fix:
     -----------------------------------------------------------------------
    Patch available at http://www.openbsd.org/errata.html

    Disclosure Timeline:
     -----------------------------------------------------------------------

    03/05/2004: Initial email to vendor.
    13/05/2004: Patch made available (without telling us)
     

    About Deprotect:
     -----------------------------------------------------------------------
    Deprotect is a Swedish based security company divided into four divisions;
    Managed Security Services, Security Services, Products and Development and
    our Security Academy.

    Deprotect - When security is first priority

     

    Contacting Deprotect:
     -----------------------------------------------------------------------
    E-mail: advisories(-at-)deprotect.com or info(-at-)deprotect.com
    Homepage: http://www.deprotect.com/
    Phone: +46-530-444 60

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Janek Vind: "[Full-Disclosure] [waraxe-2004-SA#030 - Multiple vulnerabilities in PhpNuke 6.x - 7.3]"

    Relevant Pages

    • [UNIX] Linux Virtual Server/Secure Context Procfs Shared Permissions Flaw
      ... Get your security news from a reliable source. ... Linux Virtual Server "extends the Linux ... While auditing and experimenting with VServer procfs and vproc security ... and even the host system. ...
      (Securiteam)
    • Re: /proc directory
      ... > particularly concerned about security, in which case, you don't mount ... You're downplaying the security implications quite remarkably there: ... procfs has been the source of numerous local root vulnerabilities over ...
      (freebsd-questions)