Multiple BSD Kernel Implementations 'netsmb' Kernel Module Local Denial of Service Vulnerabilities

Bugtraq ID:	41557
Class:	Input Validation Error
CVE:	CVE-2010-2530
Remote:	No
Local:	Yes
Published:	Jul 12 2010 12:00AM
Updated:	Sep 27 2010 09:50AM
Credit:	Dan Rosenberg
Vulnerable:	NetBSD NetBSD Current FreeBSD FreeBSD -current Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.5.8 Apple Mac OS X 10.6.4 Apple Mac OS X 10.5.8
Not Vulnerable:

Multiple BSD Kernel Implementations 'netsmb' Kernel Module Local Denial of Service Vulnerabilities

Multiple BSD kernels are prone to multiple local denial-of-service vulnerabilities because they fail to properly verify signedness of user-supplied values.

Attackers can exploit these issues to cause the kernel to panic, denying service to legitimate users. Given the nature of these issues, attackers may be able to execute arbitrary code, but this has not been confirmed.

These issues affect versions prior to the 'netsmb' kernel module 1.35 on NetBSD, FreeBSD, and Apple OS X where 'netsmb' is available as a kernel extension.

Multiple BSD Kernel Implementations 'netsmb' Kernel Module Local Denial of Service Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple BSD Kernel Implementations 'netsmb' Kernel Module Local Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Multiple BSD Kernel Implementations 'netsmb' Kernel Module Local Denial of Service Vulnerabilities

References:

• CVE request: NetSMB BSD kernel module (minor) (Dan Rosenberg)
  
• CVE-2010-2530: NetBSD NetSMB Module Multiple Signedness Issues (xorl)
  
• Diff for /src/sys/netsmb/smb_subr.c between version 1.34 and 1.35 (NetBSD)
  
• FreeBSD Homepage (FreeBSD)
  
• Mac OS X Homepage (Apple)
  
• Mac OS X Server Homepage (Apple)
  
• NetBSD Homepage (NetBSD)