NetBSD semop Arbitrary Code Execution Vulnerability

Bugtraq ID:	3298
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 06 2001 12:00AM
Updated:	Sep 06 2001 12:00AM
Credit:	Published in a NetBSD Security Advisory on September 6, 2001.
Vulnerable:	NetBSD NetBSD current pre20010805 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4
Not Vulnerable:	NetBSD NetBSD 1.5.2

NetBSD semop Arbitrary Code Execution Vulnerability

An input validation error exists in the NetBSD kernel that may result in a denial of service or the user execution of arbitrary code with elevated privileges.

The problem is due to insufficient length checking on a parameter passed to the semop() function. The function stores an unsigned integer argument into a local signed variable. This value is used to copy data from user memory to the process' kernel stack. By causing a signed integer overflow, it is possible for a user to bypass a bounds check.

This vulnerability can be used to write an almost arbitrary number of bytes to the process' kernel stack. It could be exploited to cause a kernel trap, call arbitrary kernel code, or execute arbitrary code on an architecture where stack memory is executable.

NetBSD semop Arbitrary Code Execution Vulnerability

Solution:
Vendor-supplied updates that rectify this issue are available:


NetBSD NetBSD current pre20010805

• NetBSD SA2001-015-kernlen-1.5.patch
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-015-kernlen-1. 5.patch

NetBSD NetBSD 1.5

• NetBSD SA2001-015-kernlen-1.5.patch
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-015-kernlen-1. 5.patch

NetBSD NetBSD 1.5.1

• NetBSD SA2001-015-kernlen-1.5.patch
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-015-kernlen-1. 5.patch

NetBSD semop Arbitrary Code Execution Vulnerability

References:

• NetBSD Security Page (NetBSD)