SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memory Access Vulnerability

Bugtraq ID:	10548
Class:	Access Validation Error
CVE:	CVE-2004-0135
Remote:	No
Local:	Yes
Published:	Jun 14 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	The vendor credits Adam Gowdiak from the Poznan Supercomputing and Networking Center for discovering this vulnerability.
Vulnerable:	SGI IRIX 6.5.24 SGI IRIX 6.5.23 SGI IRIX 6.5.22 m SGI IRIX 6.5.22 SGI IRIX 6.5.21 m SGI IRIX 6.5.21 f SGI IRIX 6.5.21 SGI IRIX 6.5.20 m SGI IRIX 6.5.20 f SGI IRIX 6.5.20 SGI IRIX 6.5.19 m SGI IRIX 6.5.19 f SGI IRIX 6.5.19 SGI IRIX 6.5.18 m SGI IRIX 6.5.18 f SGI IRIX 6.5.18 SGI IRIX 6.5.17 m SGI IRIX 6.5.17 f SGI IRIX 6.5.17 SGI IRIX 6.5.16 m SGI IRIX 6.5.16 f SGI IRIX 6.5.16 SGI IRIX 6.5.15 m SGI IRIX 6.5.15 f SGI IRIX 6.5.15 SGI IRIX 6.5.14 m SGI IRIX 6.5.14 f SGI IRIX 6.5.14 SGI IRIX 6.5.13 m SGI IRIX 6.5.13 f SGI IRIX 6.5.13 SGI IRIX 6.5.12 m SGI IRIX 6.5.12 f SGI IRIX 6.5.12 SGI IRIX 6.5.11 m SGI IRIX 6.5.11 f SGI IRIX 6.5.11 SGI IRIX 6.5.10 m SGI IRIX 6.5.10 f SGI IRIX 6.5.10 SGI IRIX 6.5.9 m SGI IRIX 6.5.9 f SGI IRIX 6.5.9 SGI IRIX 6.5.8 m SGI IRIX 6.5.8 f SGI IRIX 6.5.8 SGI IRIX 6.5.7 m SGI IRIX 6.5.7 f SGI IRIX 6.5.7 SGI IRIX 6.5.6 m SGI IRIX 6.5.6 f SGI IRIX 6.5.6 SGI IRIX 6.5.5 m SGI IRIX 6.5.5 f SGI IRIX 6.5.5 SGI IRIX 6.5.4 m SGI IRIX 6.5.4 f SGI IRIX 6.5.4 SGI IRIX 6.5.3 m SGI IRIX 6.5.3 f SGI IRIX 6.5.3 SGI IRIX 6.5.2 m SGI IRIX 6.5.2 f SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 20 SGI IRIX 6.5 .19m SGI IRIX 6.5 .19f SGI IRIX 6.5 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 XFS SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 SGI IRIX 4.0.5 IPR SGI IRIX 4.0.5 H SGI IRIX 4.0.5 G SGI IRIX 4.0.5 F SGI IRIX 4.0.5 E SGI IRIX 4.0.5 D SGI IRIX 4.0.5 A SGI IRIX 4.0.5 (IOP) SGI IRIX 4.0.5 SGI IRIX 4.0.4 T SGI IRIX 4.0.4 B SGI IRIX 4.0.4 SGI IRIX 4.0.3 SGI IRIX 4.0.2 SGI IRIX 4.0.1 T SGI IRIX 4.0.1 SGI IRIX 4.0 SGI IRIX 3.3.3 SGI IRIX 3.3.2 SGI IRIX 3.3.1 SGI IRIX 3.3 SGI IRIX 3.2
Not Vulnerable:	SGI IRIX 6.5.25

SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memory Access Vulnerability

The syssgi() system call function SGI_IOPROBE is reported to contain a flaw allowing non-privileged users to read and write kernel memory.

A local attacker would exploit this vulnerability to gain superuser privileges, or to crash the system.

SGI has released patches addressing this issue. Versions up to 6.5.25 are reported vulnerable.

SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memory Access Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memory Access Vulnerability

Solution:
SGI has released advisory 20040601-01-P dealing with this issue. Please see the referenced advisory for further information and fixes.

SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memory Access Vulnerability

References:

• IRIX Upgrade Page (Silicon Graphics Inc.)
  
• SGI Support (Silicon Graphics Inc.)