Published:
15 February 2000
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2000.027 -- NetBSD Security Advisory 1999-012 ptrace(2)'d processes can gain "kernel" privileges on vax. 16 February 2000 =========================================================================== The NetBSD Foundation, Inc. has released the following advisory concerning a possible security vulnerability in the NetBSD kernel versions prior to and including 1.4.1. This vulnerability may allow a wrapper program, constructed by a local user, to modify modify the hardware privileges of a ptrace(2)'d process. This vulnerability may allow local users to gain privileged access. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 1999-012 ================================= Topic: ptrace(2)'d processes can gain "kernel" privileges on vax. Version: NetBSD/vax 1.4.1 and earlier; -current prior to 19991212 Severity: Theoretical problem only, no known exploits Abstract ======== As part of an ongoing effort to construct a secure kernel and application environment, the NetBSD project has identified and corrected a possible security issue. A wrapper program can be constructed by a local user that can modify the hardware privileges of a ptrace(2)'d process. It might be possible to write a security-related exploit via this mechanism. Technical Details ================= NetBSD uses the ptrace(2) system call to trace and debug other processes. The debugging process can also modify the internal registers, including the status (PSL) register, for the process being debugged. Besides the normal user-accessible flags, the VAX hardware also stores information about privilege levels and used stacks in the PSL. Those flags are only altered via the instruction REI (return from interrupt) or LDPCTX (load process context) and cannot be modified while running in "user" mode. When the PSL contents are altered by the debugging process, the debugged process is in the kernel, and will get the privileges defined by the PSL when it REI to userspace to continue execution. Solutions and Workarounds ========================= Upgrade to NetBSD-current, or apply the following patch to 1.4.1: Index: machdep.c =================================================================== RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v retrieving revision 1.76.2.1 diff -c -r1.76.2.1 machdep.c *** machdep.c 1999/04/16 16:26:01 1.76.2.1 - - --- machdep.c 1999/12/12 11:08:46 *************** *** 770,776 **** tf->fp = regs->fp; tf->sp = regs->sp; tf->pc = regs->pc; ! tf->psl = regs->psl; return 0; } - - --- 770,777 ---- tf->fp = regs->fp; tf->sp = regs->sp; tf->pc = regs->pc; ! tf->psl = (regs->psl|PSL_U|PSL_PREVU) & ! ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */ return 0; } Thanks To ========= Discovery of the problem by Klaus Klein (kleink@netbsd.org) Revision History ================ 1999/12/12 - initial version More Information ================ Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 1999, The NetBSD Foundation, Inc. All Rights Reserved. $NetBSD: NetBSD-SA1999-012.txt,v 1.3 2000/02/15 13:33:47 dan Exp $ - -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBOKlXcD5Ru2/4N2IFAQEvPAP+IXJ+48+eC/iDXTDXTG4QLNsqBZT4QRki Y6DI7j0NqioiEvuJScW54dVpL0rUOd7XJH5bI27q2XEBy2J9furOwjFDb3Y4gpoU 4GWyQyw1oCd3tGecfUETlFtBdPNM6qVObEeKeQr87kbUsugSZUW+RuY4OA6Lywf7 rTMlmyoYuss= =xqwx - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBOMy1cih9+71yA2DNAQH9pwP8CTv3BUs+RH2y9UYOA5GgNlW8An+uVk/z QfgITqcP0k08uvsDe2DgI/ihnlbb59Z+cUej9FnNfLBonF9RObrhSL/AnnWcKD6P GIMqPycSr04dwVejfIKIIaVafcoCxjhxqL8mRXeXlLGKULAFAA7HQXU45m4mjOJ3 j9Cwf3sCpZI= =/Rtl -----END PGP SIGNATURE-----