FreeBSD AIO Library Cross Process Memory Write Vulnerability
BID:3661
Info
FreeBSD AIO Library Cross Process Memory Write Vulnerability
| Bugtraq ID: | 3661 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 10 2001 12:00AM |
| Updated: | Dec 10 2001 12:00AM |
| Credit: | Discovered by David Rufino <[email protected]> and posted on the BugTraq mailing list on December 10, 2001. |
| Vulnerable: |
FreeBSD FreeBSD 4.4 |
| Not Vulnerable: | |
Discussion
FreeBSD AIO Library Cross Process Memory Write Vulnerability
aio.h is a library implementing the POSIX standard for asynchronous I/O. Support for AIO may be enabled in FreeBSD by compiling the kernel with the VFS_AIO option. This option is not enabled in the default kernel configuration.
Under some circumstances, pending reads from an input socket may persist through a call to execve. Eventually the read will continue, and write to the memory space of the new process.
If a local user is able to create and execute a malicious program calling a suid program, it may be possible to overwrite arbitrary memory locations in the suid process with arbitrary data. This could immediately lead to escalated privileges.
aio.h is a library implementing the POSIX standard for asynchronous I/O. Support for AIO may be enabled in FreeBSD by compiling the kernel with the VFS_AIO option. This option is not enabled in the default kernel configuration.
Under some circumstances, pending reads from an input socket may persist through a call to execve. Eventually the read will continue, and write to the memory space of the new process.
If a local user is able to create and execute a malicious program calling a suid program, it may be possible to overwrite arbitrary memory locations in the suid process with arbitrary data. This could immediately lead to escalated privileges.
Exploit / POC
FreeBSD AIO Library Cross Process Memory Write Vulnerability
An exploit has been provided by David Rufino <[email protected]>.
An exploit has been provided by David Rufino <[email protected]>.
Solution / Fix
FreeBSD AIO Library Cross Process Memory Write Vulnerability
Solution:
This vulnerability only exists if VFS_AIO is enabled in the FreeBSD kernel. This is not enabled by default.
David Rufino <[email protected]> has provided a patch to limit AIO use to the root user, which is available at:
http://elysium.soniq.net/dr/tao/patch-01
Solution:
This vulnerability only exists if VFS_AIO is enabled in the FreeBSD kernel. This is not enabled by default.
David Rufino <[email protected]> has provided a patch to limit AIO use to the root user, which is available at:
http://elysium.soniq.net/dr/tao/patch-01
References
FreeBSD AIO Library Cross Process Memory Write Vulnerability
References:
References: