FreeBSD System Call f_count Integer Overflow Vulnerability
BID:6524
Info
FreeBSD System Call f_count Integer Overflow Vulnerability
| Bugtraq ID: | 6524 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 06 2003 12:00AM |
| Updated: | Jan 06 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to Joost Pol. |
| Vulnerable: |
FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.7 -RELEASE FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6 -RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 -RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.2 |
| Not Vulnerable: | |
Discussion
FreeBSD System Call f_count Integer Overflow Vulnerability
A vulnerability has been reported in the FreeBSD system. Reportedly, the fpathconf and lseek system calls are affected by vulnerabilities that may lead to a kernel integer overflow condition.
The FreeBSD kernel maintains an internal reference counter for any open files. This counter is incremented with a fhold() call and decremented with a fdrop() call. Reportedly, the fpathconf and lseek system calls do not issue a fdrop() call. This issue can be exploited by a local attacker by invoking repeatedly these system calls to eventually overflow the file reference counter.
An attacker who exploits this vulnerability may cause the system to panic or to obtain root privileges on the vulnerable system.
A vulnerability has been reported in the FreeBSD system. Reportedly, the fpathconf and lseek system calls are affected by vulnerabilities that may lead to a kernel integer overflow condition.
The FreeBSD kernel maintains an internal reference counter for any open files. This counter is incremented with a fhold() call and decremented with a fdrop() call. Reportedly, the fpathconf and lseek system calls do not issue a fdrop() call. This issue can be exploited by a local attacker by invoking repeatedly these system calls to eventually overflow the file reference counter.
An attacker who exploits this vulnerability may cause the system to panic or to obtain root privileges on the vulnerable system.
Exploit / POC
FreeBSD System Call f_count Integer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
FreeBSD System Call f_count Integer Overflow Vulnerability
Solution:
This vulnerability is present in all RELEASE versions of FreeBSD.
The RELENG_4 (STABLE) branch dated later than 20021111 is not vulnerable to this issue.
This vulnerability has been addressed in the CVS tree at the following location:
http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/kern/kern_descrip.c
Users are advised to obtain the fixes from the CVS tree.
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.5 -RELEASE
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.6 -RELEASE
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.7 -RELEASE
Solution:
This vulnerability is present in all RELEASE versions of FreeBSD.
The RELENG_4 (STABLE) branch dated later than 20021111 is not vulnerable to this issue.
This vulnerability has been addressed in the CVS tree at the following location:
http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/kern/kern_descrip.c
Users are advised to obtain the fixes from the CVS tree.
FreeBSD FreeBSD 4.4
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.5
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.5 -RELEASE
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.6
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.6 -RELEASE
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.7
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
FreeBSD FreeBSD 4.7 -RELEASE
-
FreeBSD filedesc.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch
References
FreeBSD System Call f_count Integer Overflow Vulnerability
References:
References:
- CVS log for src/sys/kern/kern_descrip.c (FreeBSD)
- PINE-CERT-20030101 (Joost Pol)