BID:10416

FreeBSD Msync(2) System Call Buffer Cache Implementation Vulnerability

Info

FreeBSD Msync(2) System Call Buffer Cache Implementation Vulnerability

Bugtraq ID:	10416
Class:	Design Error
CVE:	CVE-2004-0435
Remote:	No
Local:	Yes
Published:	May 26 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	This issue was discovered by Stephan Uphoff <[email protected]> and Matt Dillon <[email protected]>.
Vulnerable:	FreeBSD FreeBSD 5.2.1 -RELEASE FreeBSD FreeBSD 5.2 -RELENG FreeBSD FreeBSD 5.2 -RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 4.10 -RELENG FreeBSD FreeBSD 4.10 -RELEASE FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 4.9 -RELENG FreeBSD FreeBSD 4.9 -PRERELEASE FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 -RELENG FreeBSD FreeBSD 4.8 -RELEASE-p7 FreeBSD FreeBSD 4.8 -PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.0 -RELENG

Not Vulnerable:

Discussion

FreeBSD Msync(2) System Call Buffer Cache Implementation Vulnerability

FreeBSD msync(2) system call is prone to a vulnerability that can allow a local attacker to prevent modifications made to a file from being written to disk.

Under certain circumstances, a local user with read access to a file can prevent modifications made to a file from being written to disk. It is conjectured that an attacker can potentially cause a denial of service, if the attacker can influence a sensitive configuration file. Other attacks are possible as well. The attack would depend on the privileges held by the attacker.

Exploit / POC

FreeBSD Msync(2) System Call Buffer Cache Implementation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

FreeBSD Msync(2) System Call Buffer Cache Implementation Vulnerability

Solution:
FreeBSD has released an advisory (FreeBSD-SA-04:11.msync) to address this issue. Please see the referenced advisory for more information.

Updated versions of the operating systems are available from the vendor.

FreeBSD FreeBSD 4.10 -RELENG