Skip to main content

FreeBSD Security Advisory

New security advisory has been released by FreeBSD Security Team.

Topic: Devfs / VFS NULL pointer race condition

Category: core
Module: kern
Announced: 2009-10-02
Credits: Przemyslaw Frasunek
Affects: FreeBSD 6.x and 7.x
Corrected: 2009-05-18 10:41:59 UTC (RELENG_7, 7.2-STABLE)
2009-10-02 18:09:56 UTC (RELENG_7_2, 7.2-RELEASE-p4)
2009-10-02 18:09:56 UTC (RELENG_7_1, 7.1-RELEASE-p8)
2009-10-02 18:09:56 UTC (RELENG_6, 6.4-STABLE)
2009-10-02 18:09:56 UTC (RELENG_6_4, 6.4-RELEASE-p7)
2009-10-02 18:09:56 UTC (RELENG_6_3, 6.3-RELEASE-p13)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The device file system (devfs) provides access to system devices, such as
storage devices and serial ports, via the file system namespace.

VFS is the Virtual File System, which abstracts file system operations in
the kernel from the actual underlying file system.

II. Problem Description

Due to the interaction between devfs and VFS, a race condition exists
where the kernel might dereference a NULL pointer.

III. Impact

Successful exploitation of the race condition can lead to local kernel
privilege escalation, kernel data corruption and/or crash.

To exploit this vulnerability, an attacker must be able to run code with user
privileges on the target system.

IV. Workaround

An errata note, FreeBSD-EN-09:05.null has been released simultaneously to
this advisory, and contains a kernel patch implementing a workaround for a
more broad class of vulnerabilities. However, prior to those changes, no
workaround is available.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the
RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 6.3, 6.4,
7.1, and 7.2 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 6.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch.asc

[FreeBSD 7.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

--

You can update your system using freebsd-update

gateway# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 7.2-RELEASE from update5.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 5 patches... done.
Applying patches... done.

The following files will be updated as part of updating to 7.2-RELEASE-p4:
/boot/kernel/kernel
/boot/kernel/kernel.symbols
/usr/src/sys/conf/newvers.sh
/usr/src/sys/fs/devfs/devfs_vnops.c
/usr/src/sys/kern/kern_exec.c
gateway# freebsd-update install
Installing updates... done.

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 00:57:44 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Reboot

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 12:21:39 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Comments

Post a Comment

Popular posts from this blog

Building a KVM Proxy

Traditionally we seldomly connect our KVM from the port directly to the server that consists of usb for keyboard and mouse, vga cable for display purposes. More advanced you may have an experience using the iKVM which connect all you kvm port from the internet where you can have a remote location as long as you have the internet connection. When technology evolve, physical server are becoming obsolete since we have the virtualization technology. Since that to access your virtual machine (vm) are more easier. Instead of using SSH, like a Xen hypervisor, the Xen itself can host as a KVM server and map to the vm on different port as configured from the config file.
Post a Comment
Read more

Warning Nuffnanger's!

Dear Nuffnangers, As you might already know, there are 2 different types of campaigns from Nuffnang: Metered (mCPM) Campaigns , which pay according to the number of visitors who see the ads; and Cost-Per-Click (CPC) campaigns, which pay bloggers based on the number of clicks generated on the ads. It has come to our attention that certain groups have been committing click fraud, which is defined as clicking on CPC advertisements intentionally just to generate earnings for a blog's owner. Do note that this act is an abuse of our Terms & Conditions under Section 6. Banner ads are only supposed to be clicked on if the viewer is interested to find out more about the advertising campaign, and not for the intention of earning extra money. Should this situation worsen, the frequency of ad campaigns might be significantly reduced as we'll only be able to sell ad spaces on blogs with no click fraud record. Our system is capable of tracking these illegal actions...
2 comments
Read more

Python - Xen and libvirt

more function can be found in python dir libvirtclass.txt shell> find / -name libvirtclass.txt Generated Classes for libvir-python # # Global functions of the module # # functions from module libvirt open() openReadOnly() virEventRegisterImpl() virInitialize() # functions from module virterror virGetLastError() virResetLastError() # # Set of classes of the module # Class virDomain()     # functions from module libvirt     ID()     OSType()     XMLDesc()     attachDevice()     blockPeek()     connect()     coreDump()     create()     destroy()     detachDevice()     maxMemory()     maxVcpus()     memoryPeek() migrate()     name()     reboot()     ref()     resume()  ...
Post a Comment
Read more