BID:13527

FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability

Info

FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability

Bugtraq ID:	13527
Class:	Input Validation Error
CVE:	CVE-2005-1400
Remote:	No
Local:	Yes
Published:	May 06 2005 12:00AM
Updated:	Feb 25 2009 11:27PM
Credit:	Discovery is credited to Christer Oberg.
Vulnerable:	FreeBSD FreeBSD 5.4 -PRERELEASE FreeBSD FreeBSD 5.3 -STABLE FreeBSD FreeBSD 5.3 -RELENG FreeBSD FreeBSD 5.3 -RELEASE FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 5.2.1 -RELEASE FreeBSD FreeBSD 5.2 -RELENG FreeBSD FreeBSD 5.2 -RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 5.1 -RELENG FreeBSD FreeBSD 5.1 -RELEASE/Alpha FreeBSD FreeBSD 5.1 -RELEASE-p5 FreeBSD FreeBSD 5.1 -RELEASE FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 5.0 -RELENG FreeBSD FreeBSD 5.0 -RELEASE-p14 FreeBSD FreeBSD 5.0 alpha FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.11 -STABLE FreeBSD FreeBSD 4.11 -RELENG FreeBSD FreeBSD 4.11 -RELEASE-p3 FreeBSD FreeBSD 4.10 -RELENG FreeBSD FreeBSD 4.10 -RELEASE-p8 FreeBSD FreeBSD 4.10 -RELEASE FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 4.9 -RELENG FreeBSD FreeBSD 4.9 -PRERELEASE FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 -RELENG FreeBSD FreeBSD 4.8 -RELEASE-p7 FreeBSD FreeBSD 4.8 -PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 -STABLE FreeBSD FreeBSD 4.7 -RELENG FreeBSD FreeBSD 4.7 -RELEASE-p17 FreeBSD FreeBSD 4.7 -RELEASE Apple Mac OS X Server 10.5.5 Apple Mac OS X 10.5.5

Not Vulnerable:

Discussion

FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability

The 'i386_get_ldt(2)' system call is prone to a memory-disclosure vulnerability.

An attacker can supply a negative or excessive value as an argument to the affected system call and read arbitrary portions of kernel memory.

Information disclosed through this attack may help the attacker launch other attacks against a computer and potentially aid in a complete compromise.

NOTE: Only i386 and amd64 architectures are affected by this issue.

UPDATE (February 25, 2009): Mac OS X 10.5.5 is reported vulnerable.

Exploit / POC

FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability

The following exploit for Mac OS X is available:

/data/vulnerabilities/exploits/13527_mu-b.c

Solution / Fix

FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability

Solution:
The vendor has released advisory FreeBSD-SA-05:07.ldt including patches to address this issue in FreeBSD 4.10, 4.11, and 5.3 systems. Please see the referenced advisory for more information.

FreeBSD FreeBSD 4.10 -RELEASE-p8