Skip to main content

FreeBSD Security Advisory

New security advisory has been released by FreeBSD Security Team.

Topic: Devfs / VFS NULL pointer race condition

Category: core
Module: kern
Announced: 2009-10-02
Credits: Przemyslaw Frasunek
Affects: FreeBSD 6.x and 7.x
Corrected: 2009-05-18 10:41:59 UTC (RELENG_7, 7.2-STABLE)
2009-10-02 18:09:56 UTC (RELENG_7_2, 7.2-RELEASE-p4)
2009-10-02 18:09:56 UTC (RELENG_7_1, 7.1-RELEASE-p8)
2009-10-02 18:09:56 UTC (RELENG_6, 6.4-STABLE)
2009-10-02 18:09:56 UTC (RELENG_6_4, 6.4-RELEASE-p7)
2009-10-02 18:09:56 UTC (RELENG_6_3, 6.3-RELEASE-p13)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The device file system (devfs) provides access to system devices, such as
storage devices and serial ports, via the file system namespace.

VFS is the Virtual File System, which abstracts file system operations in
the kernel from the actual underlying file system.

II. Problem Description

Due to the interaction between devfs and VFS, a race condition exists
where the kernel might dereference a NULL pointer.

III. Impact

Successful exploitation of the race condition can lead to local kernel
privilege escalation, kernel data corruption and/or crash.

To exploit this vulnerability, an attacker must be able to run code with user
privileges on the target system.

IV. Workaround

An errata note, FreeBSD-EN-09:05.null has been released simultaneously to
this advisory, and contains a kernel patch implementing a workaround for a
more broad class of vulnerabilities. However, prior to those changes, no
workaround is available.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the
RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 6.3, 6.4,
7.1, and 7.2 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 6.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch.asc

[FreeBSD 7.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

--

You can update your system using freebsd-update

gateway# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 7.2-RELEASE from update5.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 5 patches... done.
Applying patches... done.

The following files will be updated as part of updating to 7.2-RELEASE-p4:
/boot/kernel/kernel
/boot/kernel/kernel.symbols
/usr/src/sys/conf/newvers.sh
/usr/src/sys/fs/devfs/devfs_vnops.c
/usr/src/sys/kern/kern_exec.c
gateway# freebsd-update install
Installing updates... done.

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 00:57:44 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Reboot

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 12:21:39 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Comments

Post a Comment

Popular posts from this blog

Python - Xen and libvirt

more function can be found in python dir libvirtclass.txt shell> find / -name libvirtclass.txt Generated Classes for libvir-python # # Global functions of the module # # functions from module libvirt open() openReadOnly() virEventRegisterImpl() virInitialize() # functions from module virterror virGetLastError() virResetLastError() # # Set of classes of the module # Class virDomain()     # functions from module libvirt     ID()     OSType()     XMLDesc()     attachDevice()     blockPeek()     connect()     coreDump()     create()     destroy()     detachDevice()     maxMemory()     maxVcpus()     memoryPeek() migrate()     name()     reboot()     ref()     resume()     save()     setAutostart()     setMaxMemory()     setMemory()     setVcpus()     shutdown()     suspend()     undefine()     # functions from module python     UUID()     UUIDString()     autostart()     blockStats()     info()     interfaceStats()     pinVc
Post a Comment
Read more

Building a KVM Proxy

Traditionally we seldomly connect our KVM from the port directly to the server that consists of usb for keyboard and mouse, vga cable for display purposes. More advanced you may have an experience using the iKVM which connect all you kvm port from the internet where you can have a remote location as long as you have the internet connection. When technology evolve, physical server are becoming obsolete since we have the virtualization technology. Since that to access your virtual machine (vm) are more easier. Instead of using SSH, like a Xen hypervisor, the Xen itself can host as a KVM server and map to the vm on different port as configured from the config file.
Post a Comment
Read more

Complete guide to update/upgrade cakephp

This is what people always forgotten. How to update your cakephp to the latest from CLI         phpmamp composer.phar update How to upgrade to 3.* branch     phpmamp composer.phar require --update-with-dependencies "cakephp/cakephp:3.5.*"         ./composer.json has been updated Loading composer repositories with package information Updating dependencies (including require-dev)       - Removing cakephp/cakephp (3.4.13)       - Installing cakephp/cakephp (3.5.6)         Downloading: 100% Writing lock file Generating autoload files Done !
Post a Comment
Read more