OpenBSD setitimer(2) Kernel Memory Overwrite Vulnerability

Bugtraq ID:	5861
Class:	Input Validation Error
CVE:	CVE-2002-2180
Remote:	No
Local:	Yes
Published:	Oct 02 2002 12:00AM
Updated:	Nov 03 2007 01:16AM
Credit:	Reported by OpenBSD.
Vulnerable:	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0
Not Vulnerable:

OpenBSD setitimer(2) Kernel Memory Overwrite Vulnerability

OpenBSD has reported a vulnerability in the 'setitimer(2)' system call. The vulnerability likely stems from an error in handling signed integers. Exploiting this vulnerability may allow local attackers to write to kernel memory and obtain root privileges.

Other BSD-based operating systems are likely vulnerable.

OpenBSD setitimer(2) Kernel Memory Overwrite Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

OpenBSD setitimer(2) Kernel Memory Overwrite Vulnerability

Solution:
OpenBSD has made available source code patches for OpenBSD 3.1 and 3.0.


OpenBSD OpenBSD 3.0

• OpenBSD 032_kerntime.patch
  Apply by doing: cd /usr/src patch -p0 < 032_kerntime.patchAnd then rebuild your kernel.
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patc h

OpenBSD OpenBSD 3.1

• OpenBSD 015_kerntime.patch
  Apply by doing: cd /usr/src patch -p0 < 015_kerntime.patchAnd then rebuild your kernel.
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patc h