Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2013.0113 kernel panic triggered from userland 29 January 2013 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel Publisher: NetBSD Operating System: NetBSD Impact/Access: Denial of Service -- Existing Account Resolution: Patch/Upgrade Original Bulletin: http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2013-001.txt.asc - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2013-001 ================================= Topic: kernel panic triggered from userland Version: NetBSD-current: affected prior to Dec 29th, 2012 NetBSD 6.0.*: affected NetBSD 6.0: affected NetBSD 5.1.*: not affected NetBSD 5.0.*: not affected NetBSD 5.0: not affected Severity: Local system crash Fixed: NetBSD-current: Dec 29th, 2012 NetBSD-6-0 branch: Jan 7th, 2013 NetBSD-6 branch: Jan 7th, 2013 Please note that NetBSD releases prior to 5.0 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract ======== A user can panic the machine by using ktrace or ktruss on a program sleeping in recvmsg. Technical Details ================= If an untraced process sleeps in recvmsg/sendmsg, the syscall does not allocate an iov structure for ktrace. When tracing is then enabled and the process wakes up, it crashes the kernel. A local user could intentionally crash the machine by running a program that entered the required sleep state, and then call ktrace or ktruss on it. Solutions and Workarounds ========================= The following versions contain the fix: src/sys/kern/uipc_syscalls.c HEAD 1.158 netbsd-6 1.154.2.2 netbsd-6-0 1.154.2.1.4.1 For all affected NetBSD versions, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel. In these instructions, replace: ARCH with your architecture (from uname -m), and KERNCONF with the name of your kernel configuration file. To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P sys/kern/uipc_syscalls.c # ./build.sh kernel=KERNCONF # mv /netbsd /netbsd.old # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd # shutdown -r now For more information on how to do this, see: http://www.NetBSD.org/guide/en/chap-kernel.html Thanks To ========= Thanks to Michael van Elst for finding and fixing this problem. Revision History ================ 2013-01-28 Initial release More Information ================ Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2013-001.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ . Copyright 2013, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. $NetBSD: NetBSD-SA2013-001.txt,v 1.1 2013/01/28 11:12:51 tonnerre Exp $ - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJRBl1CAAoJEAZJc6xMSnBuXdgQAICblrbsfIYWj59b/y2BpyDM v1m01WzTeAxWXhpq1eMZg7RFm/IDWcqxZ5RbmH11U4htClz5i7LKHMv8M1ttkyaq Sus84jnQhOsU9peCeVjhnFnXuTogzaw1pCREHmCT7yqInLSc5TrYCvq3rDsWMm8Y VT0ht6ri9De7woch5IIMkDSK2QKGFba2z0X0OgBsXvrDDoWWj4G7FLiYlWSe1TLN nGvxsoGjeQjHg51wzqkEbVve5eCrZh0MKrcG9UUOZZDI0vbUCCXcvZgE/cfS7alk I3Naak3yCnNFbUn9lB5Wu1svbZ92jHPyOyIZO3WrOvqHkkEqQci6Wgh5U9cBGlTI PEZiRQ8CjhsRs9yIfm4p1ArMoB5DzK6kCeb7JfTcSUp/8OfRjQqVw3YINYgKLQ7j agLGt1XT79sEh6yuraJaneUXLiuOVhVpM3+eIYtWGwwb9xFUxTJRi0p0b77ulXqI KLTHYPUa1v6gSUc7QO41tdz0veGAG7O5LVr5gG77GcwJ3BaWwDHUJJ3Tcf5tPO8v wuZZsbpX2Y50zQ3h+QbgOMEGWeyKWxvSCfDFvtCUA8PxeUOmR+/oiWfMxUDLG1tW jkLdJ94wXvTyCSYlQBZD5tikVDI2o5LCHd5a9Da8GHQvyhKO64s04z5T9U2pIKxv guqOI+FKmOMN/mvRYUJd =2yOG - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUQckL+4yVqjM2NGpAQI36Q//bLVXOHnb1dywrQWYYVS6s/u2y2TqA+tV CXgsk2nyWT6zdtgFTzAJqTIyosLybeiPZwEwdZdZoKYzHKJdW3PaItKdDdXezRQ+ /GunccMMsVEx5mq0in6QOLAWNiUA1a56ap7zH9tTvDbnGKac0D6xbljOnZV25v1x w4wJMIEqN7y1O+Mu1+BvCiMuCsHCVFw+kOzUaIyMNTW8tVOqcRcSStk6IaE5Lp1d pKg+Rs6H87Palh5+/s5yVqVv5yZ0+ZewDeXaKpXDFjTKR69R8Uc762ZiAYyAdjvh fVpZBwSnRQBS/JQ9Pbw5N7AdNz1VPzB6X19sJar+DpgLf4lnNx4mA+Mtb1f39MAB 78TpqzShQaIjAY2Zmn9609W8ojRK5ZcvwWoRnWilC/CD01EwXNH7W7av2e1ZUMHI 73bQy0T51iy/7MvTOTvhXnC8Yb3EFSz9l5cMrJigFnWWzcTrcQsQARsrqoPJNjM+ 9QjG09f5v9gOApTyET6hc8szoyS6iEw998rFATCAhkFU2LiNAEZH4eBk2m5EJQjn bRD9yp+u8HJNBlnVkysh1fLh2mMYaip8FAyfiApwCjMSrmsYwJVhWHpuLLf3uV4a VFM36Gvl196I0lAkVY1L4r5zI7S5EO1J4OczjxIDjLhbMNRVz70qlIJiH5YrelUD ASNYWVTF7e8= =Xe2s -----END PGP SIGNATURE-----