Multiple Vendor KernFS LSEEK Local Kernel Memory Disclosure Vulnerability

Bugtraq ID:	16173
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 09 2006 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	Ejovi Nuwere from SecurityLab reported this issue to the vendor.
Vulnerable:	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 OpenBSD OpenBSD 3.8 OpenBSD OpenBSD 3.7 OpenBSD OpenBSD 3.6 OpenBSD OpenBSD 3.5 OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD 1.6.2 NetBSD NetBSD 1.6.1 NetBSD NetBSD 1.6 beta NetBSD NetBSD 1.6 NetBSD NetBSD 1.5.3 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 x86 NetBSD NetBSD 1.5 sh3 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 x86 NetBSD NetBSD 1.4.2 SPARC NetBSD NetBSD 1.4.2 arm32 NetBSD NetBSD 1.4.2 Alpha NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 x86 NetBSD NetBSD 1.4.1 SPARC NetBSD NetBSD 1.4.1 sh3 NetBSD NetBSD 1.4.1 arm32 NetBSD NetBSD 1.4.1 Alpha NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.4 SPARC NetBSD NetBSD 1.4 arm32 NetBSD NetBSD 1.4 Alpha NetBSD NetBSD 1.4 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 NetBSD NetBSD Current
Not Vulnerable:	NetBSD NetBSD 2.0.3 Navision Financials Server 3.0

Multiple Vendor KernFS LSEEK Local Kernel Memory Disclosure Vulnerability

The 'kernfs' filesystem in both NetBSD and OpenBSD is prone to a kernel memory disclosure vulnerability. This issue arises due to insufficient sanitization of user-supplied arguments passed to the 'lseek()' system call.

An attacker may use information disclosed through this attack to launch other attacks against a computer and potentially to aid in a complete compromise.

Note that OpenBSD has completely removed kernfs since OpenBSD 3.8; version 3.7 had kernfs support disabled in their GENERIC kernel, and has never mounted the kernfs filesystem by default.

Multiple Vendor KernFS LSEEK Local Kernel Memory Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Vendor KernFS LSEEK Local Kernel Memory Disclosure Vulnerability

Solution:

NetBSD has released advisory NetBSD-SA2006-001, along with patches to
address this issue. Fixes have been committed to NetBSD's CVS tree as of
29 November, 2005. Please see the referenced advisory for further
information on obtaining and applying fixes.

OpenBSD has removed kernfs support since the release of OpenBSD 3.8.
OpenBSD-current (as of 24 Nov, 2005) no longer contains the kernfs
filesystem.

Multiple Vendor KernFS LSEEK Local Kernel Memory Disclosure Vulnerability

References:

• Announcing update 2.0.3 - source only (NetBSD)
  
• NetBSD Homepage (NetBSD)
  
• NetBSD Security Page (NetBSD)
  
• [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion (SecurityLab Research )