Skip to main content

FreeBSD Security Advisory

New security advisory has been released by FreeBSD Security Team.

Topic: Devfs / VFS NULL pointer race condition

Category: core
Module: kern
Announced: 2009-10-02
Credits: Przemyslaw Frasunek
Affects: FreeBSD 6.x and 7.x
Corrected: 2009-05-18 10:41:59 UTC (RELENG_7, 7.2-STABLE)
2009-10-02 18:09:56 UTC (RELENG_7_2, 7.2-RELEASE-p4)
2009-10-02 18:09:56 UTC (RELENG_7_1, 7.1-RELEASE-p8)
2009-10-02 18:09:56 UTC (RELENG_6, 6.4-STABLE)
2009-10-02 18:09:56 UTC (RELENG_6_4, 6.4-RELEASE-p7)
2009-10-02 18:09:56 UTC (RELENG_6_3, 6.3-RELEASE-p13)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The device file system (devfs) provides access to system devices, such as
storage devices and serial ports, via the file system namespace.

VFS is the Virtual File System, which abstracts file system operations in
the kernel from the actual underlying file system.

II. Problem Description

Due to the interaction between devfs and VFS, a race condition exists
where the kernel might dereference a NULL pointer.

III. Impact

Successful exploitation of the race condition can lead to local kernel
privilege escalation, kernel data corruption and/or crash.

To exploit this vulnerability, an attacker must be able to run code with user
privileges on the target system.

IV. Workaround

An errata note, FreeBSD-EN-09:05.null has been released simultaneously to
this advisory, and contains a kernel patch implementing a workaround for a
more broad class of vulnerabilities. However, prior to those changes, no
workaround is available.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the
RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 6.3, 6.4,
7.1, and 7.2 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 6.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs6.patch.asc

[FreeBSD 7.x]
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch
# fetch http://security.FreeBSD.org/patches/SA-09:14/devfs7.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

--

You can update your system using freebsd-update

gateway# freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 7.2-RELEASE from update5.FreeBSD.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Inspecting system... done.
Preparing to download files... done.
Fetching 5 patches... done.
Applying patches... done.

The following files will be updated as part of updating to 7.2-RELEASE-p4:
/boot/kernel/kernel
/boot/kernel/kernel.symbols
/usr/src/sys/conf/newvers.sh
/usr/src/sys/fs/devfs/devfs_vnops.c
/usr/src/sys/kern/kern_exec.c
gateway# freebsd-update install
Installing updates... done.

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 00:57:44 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Reboot

gateway# uname -a
FreeBSD gateway.local 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 12:21:39 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

Comments

Post a Comment

Popular posts from this blog

Warning Nuffnanger's!

Dear Nuffnangers, As you might already know, there are 2 different types of campaigns from Nuffnang: Metered (mCPM) Campaigns , which pay according to the number of visitors who see the ads; and Cost-Per-Click (CPC) campaigns, which pay bloggers based on the number of clicks generated on the ads. It has come to our attention that certain groups have been committing click fraud, which is defined as clicking on CPC advertisements intentionally just to generate earnings for a blog's owner. Do note that this act is an abuse of our Terms & Conditions under Section 6. Banner ads are only supposed to be clicked on if the viewer is interested to find out more about the advertising campaign, and not for the intention of earning extra money. Should this situation worsen, the frequency of ad campaigns might be significantly reduced as we'll only be able to sell ad spaces on blogs with no click fraud record. Our system is capable of tracking these illegal actions...
2 comments
Read more

Zenclouds October Promotion - Malaysia VPS Hosting

For those who are not familiar with what Zenclouds.com is , check this out : Zenclouds subsidiary of Art In Software Sdn Bhd is an industry-leading, privately virtual private server hosting and software services provider with headquarters in Malaysia. Since 2003, the company has provided businesses worldwide with reliable, high-capacity networks to host websites, email, business applications, video and other modern, rich-media content. Zenclouds evolve in one year of research and development mainly focus on Control Panel for managing virtual private server. Zenclouds integrate between Xen technologies and our own Control Panel to ease our customer managing multiple server with different Data Center with one control panel. Zenclouds integrates the industry's best technologies for each customer's specific need and delivers it as a service via the company's commitment and support. For this upcoming October you can win and own a brand new iPod Shuffle, Nano and Touch when y...
3 comments
Read more

MySQL Enterprise thingy

It's been a weird thing when you install MySQL server especially the one that is 'enterprise' version is not working with your PHP. That is the problem that my friend and I facing today. Since PHP require php-mysql extension to connect to MySQL server but php-mysql is only work with mysql-server from the Repos (Redhat/Centos). 1) Remove default mysql-server/php-mysql 2) Install MySQL Enterprise 3) Dependencies conflict occur + headache + install php-mysql shell> yum install php-mysql Loaded plugins: rhnplugin, security Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package php-mysql.x86_64 0:5.1.6-27.el5 set to be updated --> Processing Dependency: libmysqlclient.so.15(libmysqlclient_15)(64bit) for package: php-mysql --> Processing Dependency: libmysqlclient.so.15()(64bit) for package: php-mysql --> Running transaction check ---> Package mysql.x86_64 0:5.0.77-4.el5_4.2 set to be updated --> Process...
2 comments
Read more