Date: Tue, 17 Sep 2002 11:56:30 +1000
From: NetBSD Security Officer <security-officer@netbsd.org.>
To: [email protected]Subject: NetBSD Security Advisory 2002-007: Repeated TIOCSCTTY ioctl can corrupt session hold counts
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2002-007
Topic: Repeated TIOCSCTTY ioctl can corrupt session hold counts
Version: NetBSD-current: source prior to July 21, 2002
NetBSD-1.6 beta: source prior to July 23, 2002
NetBSD-1.5.*: source prior to September 5, 2002
NetBSD-1.5.3: affected
NetBSD-1.5.2: affected
NetBSD-1.5.1: affected
NetBSD-1.5: affected
NetBSD-1.4.*: affected
Severity: Local user can cause system panic
Fixed: NetBSD-current: July 21, 2002
NetBSD-1.6 branch: July 23, 2002 (1.6 includes the fix)
NetBSD-1.5 branch: September 5, 2002
NetBSD-1.4 branch: not yet
Abstract
========
A Session leader can use the TIOCSCTTY ioctl to set the session
controlling terminal. This ioctl can be called any number of times.
The call unconditionally raised the hold count of a kernel structure
shared between processes in the same session. It was possible to
overflow the structure counter, and thus arrange for the structure
memory to be freed prematurely, and possibly re-used. This could
cause a kernel panic or incorrect operation the next time the session
structure is accessed from the context of other processes which are
part of the former session.
Technical Details
=================
A process can start a new session (and thus create a new session
leader), by forking a child and exiting. The new child can then call
setsid(2) to create a new session, and thus become a session
leader. The child process can then call the TIOCSCTTY ioctl.
Structures shared between multiple processes (such as the session
structure) normally contain counters to keep track of how many times a
structure is referenced. Typically, macros are used to increase/decrease
the use counter, and the structure is freed when the counter goes to
zero.
By repeatedly invoking TIOCSCTTY, it's possible to overflow the integer
counter such that when a process exits (and thus the session structure
counter is decreased), the counter hits zero and structure is freed even
though other processes still reference it. Depending on kernel options,
this might immediately cause the memory to be overwritten with junk
data, or the memory will be overwritten by random other data when the
memory is allocated to something else. In either case, if any of the
processes of the old session group access the memory, they would very
likely follow trashed pointers and cause a kernel panic.
Solutions and Workarounds
NetBSD official releases up to and including 1.5.3 are vulnerable.
The recent NetBSD 1.6 release is not vulnerable to this issue. A full
upgrade to NetBSD 1.6 is the recommended resolution for all users able
to do so. Many security-related improvements have been made, and
indeed this release has been delayed several times in order to include
fixes for a number of recent issues.
Otherwise, kernel sources must be updated and a new kernel built and
installed. Once the kernel sources have been updated, rebuild the
kernel, install it, and reboot. For more information on how to do
this, see:
http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel
The instructions for updating your kernel sources depend upon which
particular NetBSD release you are running.
* NetBSD-current:
Systems running NetBSD-current dated from before 2002-07-21
should be upgraded to NetBSD-current dated 2002-07-22 or later.
The following directories need to be updated from the
netbsd-current CVS branch (aka HEAD):
src/sys/kern/
Alternatively, apply the following patch (with potential offset
differences):
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch
To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch
Configure, compile, install and boot a new kernel according to
the instructions at:
http://www.netbsd.org/Documentation/kernel/#building_a_kernel
* NetBSD 1.6 beta:
Systems running NetBSD 1.6 BETAs and Release Candidates should
be upgraded to the NetBSD 1.6 release.
If a source-based point upgrade is required, sources from the
NetBSD-1.6 branch dated 2002-07-23 or later should be used.
The following directories need to be updated from the
netbsd-1-6 CVS branch:
src/sys/kern/
Alternatively, apply the following patch (with potential offset
differences):
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch
To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch
Configure, compile, install and boot a new kernel according to
the instructions at:
http://www.netbsd.org/Documentation/kernel/#building_a_kernel
* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:
Systems running NetBSD 1.5.x dated from before 2002-09-05
should be upgraded to NetBSD-1.5 branch dated 2002-09-05 or later.
The following directories need to be updated from the
netbsd-1-5 CVS branch:
src/sys/kern/
Alternatively, apply the following patch (with potential offset
differences):
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2002-007-tiocsctty.patch
To patch:
# cd src/sys
# patch < /path/to/SA2002-007-tiocsctty.patch
Configure, compile, install and boot a new kernel according to
the instructions at:
http://www.netbsd.org/Documentation/kernel/#building_a_kernel
* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:
The advisory will be updated to include instructions to remedy
this problem for systems running the NetBSD-1.4 branch.
Thanks To
=========
David Laight, for finding the problem and original patches.
Jaromir Dolecek, for fix and initial advisory text.
The NetBSD Release Engineering teams, for great patience and
assistance in dealing with repeated security issues discovered
recently.
Revision History
================
2002-09-16 Initial release
More Information
================
An up-to-date PGP signed copy of this release will be maintained at
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-007.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2002-007.txt,v 1.13 2002/09/16 05:17:55 dan Exp $
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAwUBPYVp6T5Ru2/4N2IFAQFJlQQAyVqJqrdjewQrmRFSQb3HmwESQYe7mhtw
Wc36bXxVYS35u3ctz3HL9soMfKoBxQfJhEWozAM6hTi6I0ISnX2mPVqTTBOmHENT
5AfhIJQmynx5yorVguEHp9E/zPvKo90lLKuz4KwAY6Fonzx/qT9YTk1DzJkYUrki
umJi1sasvAU=
=XDgt
-----END PGP SIGNATURE-----
