NetBSD Super-H Port sigreturn() Input Validation Vulnerability

Bugtraq ID:	2810
Class:	Input Validation Error
CVE:	CVE-2001-0734
Remote:	No
Local:	Yes
Published:	May 30 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	This vulnerability was reportedly discovered by Klaus Klein.
Vulnerable:	NetBSD NetBSD 1.5 sh3 NetBSD NetBSD 1.4.1 sh3
Not Vulnerable:

NetBSD Super-H Port sigreturn() Input Validation Vulnerability

Ports of NetBSD for the Hitachi SuperH architecture contain a vulnerability in their implementation of sigreturn().

Sigreturn() is a system call that is used to resume process execution when the signal handler is finished executing.

This vulnerability could allow for a user-process to resume execution in privileged execution mode after a signal handler has returned.

Exploitation of this vulnerability could lead to a root compromise.

Note: A very similar bug exists in the kernel function 'process_write_regs()'. This function is used internally by the ptrace()/procfs implementations, though it may be passed data that is originally user-supplied. If this is the case, then this vulnerability may be exploitable in the same manner as the sigreturn() vulnerability.

NetBSD Super-H Port sigreturn() Input Validation Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NetBSD Super-H Port sigreturn() Input Validation Vulnerability

Solution:
NetBSD has released source-code patches for this vulnerability.


NetBSD NetBSD 1.5 sh3

• NetBSD 1.5 sh3patch.diff
  http://www.securityfocus.com/web/data/vulnerabilities/patches/sh3patch .diff

NetBSD Super-H Port sigreturn() Input Validation Vulnerability

References:

• NetBSD Security Page (NetBSD)
  
• NetBSD SuperH Port Homepage (NetBSD)