full-disclosure - OpenBSD procfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040517174513.79812.qmail@mail1.deprotect.com>
From: advisories at deprotect.com (Deprotect Advisories)
Subject: OpenBSD procfs

 -----------------------------------------------------------------------
Deprotect Security Advisory 20041405
 -----------------------------------------------------------------------
Advisory ID  : DEPROTECT-20041405
Authors      : Christer Oberg, Joel Soderberg
Publish date : 17/05/2004
Application  : Procfs
Version(s)   : 3.5 (and earlier versions)
Platforms    : OpenBSD
CVE#         :
Availability : http://www.deprotect.com/advisories/DEPROTECT-20041305.txt
 ----------------------------------------------------------------------- 


Problem:
 -----------------------------------------------------------------------
Kernel memory disclosure via procfs. 


Description:
 -----------------------------------------------------------------------
Several integer related bugs in the procfs code can lead to kernel
memory disclosure. For example it is possible to trick procfs to return
large chunks of kernel memory when reading the cmdline file of system
processes. 

This code is found in procfs_cmdline.c: 

	if (P_ZOMBIE(p) || (p->p_flag & P_SYSTEM) != 0) {
               len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm);
               xlen = len - uio->uio_offset;
               if (xlen <= 0)
                       error = 0;
               else
                       error = uiomove(arg, xlen, uio);
		free(arg, M_TEMP);
               return (error);	
	} 


It is trivial to for example pread() the descriptor with an offset and
have it return more data than it should. There are other examples of
similar bugs in the procfs code. 

 

Workaround:
 -----------------------------------------------------------------------
Unmount procfs. 


Fix:
 -----------------------------------------------------------------------
Patch available at http://www.openbsd.org/errata.html 


Disclosure Timeline:
 ----------------------------------------------------------------------- 

03/05/2004: Initial email to vendor.
13/05/2004: Patch made available (without telling us)
 


About Deprotect:
 -----------------------------------------------------------------------
Deprotect is a Swedish based security company divided into four divisions;
Managed Security Services, Security Services, Products and Development and
our Security Academy. 

Deprotect - When security is first priority 

 

Contacting Deprotect:
 -----------------------------------------------------------------------
E-mail:    advisories(-at-)deprotect.com or info(-at-)deprotect.com
Homepage:  http://www.deprotect.com/
Phone:     +46-530-444 60