BID:10529 - NetBSD Swapctl() Local Denial Of Service Vulnerability

NetBSD Swapctl() Local Denial Of Service Vulnerability

BID:10529

Info

NetBSD Swapctl() Local Denial Of Service Vulnerability

Bugtraq ID:	10529
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Jun 11 2004 12:00AM
Updated:	Jun 11 2004 12:00AM
Credit:	"Evgeny Demidov" <[email protected]> disclosed this vulnerability to the vendor.
Vulnerable:	NetBSD NetBSD current pre20010805 NetBSD NetBSD 2.0 NetBSD NetBSD 1.6.2 NetBSD NetBSD 1.6.1 NetBSD NetBSD 1.6 beta NetBSD NetBSD 1.6 NetBSD NetBSD 1.5.3 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 x86 NetBSD NetBSD 1.5 sh3 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 x86 NetBSD NetBSD 1.4.2 SPARC NetBSD NetBSD 1.4.2 arm32 NetBSD NetBSD 1.4.2 Alpha NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 x86 NetBSD NetBSD 1.4.1 SPARC NetBSD NetBSD 1.4.1 sh3 NetBSD NetBSD 1.4.1 arm32 NetBSD NetBSD 1.4.1 Alpha NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.4 SPARC NetBSD NetBSD 1.4 arm32 NetBSD NetBSD 1.4 Alpha NetBSD NetBSD 1.4 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 NetBSD NetBSD current pre20010701

Not Vulnerable:	NetBSD NetBSD Current

Discussion

NetBSD Swapctl() Local Denial Of Service Vulnerability

NetBSD's swapctl() system call is reported susceptible to a local denial of service vulnerability.

It manifests itself as an integer overflow condition in in the swapctl() system call. This issue may be exploited by local users to trigger a kernel panic, effectively denying service to legitimate users.

This has been fixed in NetBSD-current, and the NetBSD-2-0 branch of CVS.

Exploit / POC

NetBSD Swapctl() Local Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

NetBSD Swapctl() Local Denial Of Service Vulnerability

Solution:
There is a patch in NetBSD-current dealing with this issue. It could likely be applied to other version of NetBSD as well.

Please see the fixes section for the patch.

NetBSD NetBSD current pre20010805

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD current pre20010701

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.0

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.2

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.2.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.3.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.3.2

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.3.3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4 x86

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4 Alpha

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4 SPARC

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4 arm32

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1 Alpha

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1 arm32

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1 x86

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1 SPARC

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.1 sh3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.2

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.2 x86

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.2 arm32

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.2 Alpha

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.2 SPARC

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.4.3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5 x86

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5 sh3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5.2

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.5.3

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.6 beta

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.6

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.6.1

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 1.6.2

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

NetBSD NetBSD 2.0

NetBSD uvm_swap.c patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/uvm/uvm_swap.c.diff?r1=1.8 5&r2=1.85.2.1

References

NetBSD Swapctl() Local Denial Of Service Vulnerability

References:

NetBSD Homepage (NetBSD)
NetBSD Security Page (NetBSD)
NetBSD kernel swapctl(2) vulnerability ("Evgeny Demidov" )