NetBSD 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

Bugtraq ID:	36430
Class:	Design Error
CVE:	CVE-2009-2793
Remote:	No
Local:	Yes
Published:	Sep 16 2009 12:00AM
Updated:	Sep 17 2009 04:30PM
Credit:	Tavis Ormandy and Julien Tinnes
Vulnerable:	NetBSD NetBSD 5.0.1 NetBSD NetBSD 4.0.2 NetBSD NetBSD 4.0.1 NetBSD NetBSD 3.0.2 NetBSD NetBSD 3.0.1 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD 1.6.2 NetBSD NetBSD 1.6.1 NetBSD NetBSD 1.6 beta NetBSD NetBSD 1.6 NetBSD NetBSD 1.5.3 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 x86 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 x86 NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 x86 NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.4 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 NetBSD NetBSD 5.0 RC3 NetBSD NetBSD 5.0 NetBSD NetBSD 4.1 NetBSD NetBSD 4.0 BETA2 NetBSD NetBSD 4.0 NetBSD NetBSD 4,0_Beta NetBSD NetBSD 3.1_RC3 NetBSD NetBSD 3.1 NetBSD NetBSD 3.1 NetBSD NetBSD 3,1_RC1 NetBSD NetBSD 2.1.1 NetBSD NetBSD 2.0.4 Navision Financials Server 3.0
Not Vulnerable:

NetBSD 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

NetBSD is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges or may aid in further attacks.

NetBSD 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/36430.c

NetBSD 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NetBSD 'IRET' General Protection Fault Handling Local Privilege Escalation Vulnerability

References:

• CVE-2009-2793: Iret #GP on pre-commit handling failure: the NetBSD case (Julien Tinnes)
  
• Iret #GP on pre-commit handling failure: the NetBSD case (CVE-2009-2793) (Tavis Ormandy and Julien Tinnes)
  
• NetBSD Homepage (NetBSD)
  
• Iret #GP on pre-commit handling failure: the NetBSD case (CVE-2009-2793) (Julien TINNES )