FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
BID:8387
Info
FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
| Bugtraq ID: | 8387 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 11 2003 12:00AM |
| Updated: | Aug 11 2003 12:00AM |
| Credit: | This vulnerability was announced by FreeBSD in a security advisory. |
| Vulnerable: |
FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 |
| Not Vulnerable: | |
Discussion
FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
A vulnerability has been discovered within the FreeBSD ptrace() system call and the spigot device driver. The issue exists due to the said components failing to carry out sufficient sanity checks when handling signal numbers.
As a result of this design error, it is possible to pass a negative signal number to one of the vulnerable pieces of code, which will effectively result in an out-of-bounds or negative signal being delivered by the mechanism. This will typically result in an assertion failure or system panic, causing the system to crash.
This issue could be exploited by an unprivileged attacker to crash a system to which they have local access. It should be noted that under default FreeBSD 5.x kernels, it may be possible for an attacker to exploit this issue in such a way as to execute arbitrary code with root privileges.
A vulnerability has been discovered within the FreeBSD ptrace() system call and the spigot device driver. The issue exists due to the said components failing to carry out sufficient sanity checks when handling signal numbers.
As a result of this design error, it is possible to pass a negative signal number to one of the vulnerable pieces of code, which will effectively result in an out-of-bounds or negative signal being delivered by the mechanism. This will typically result in an assertion failure or system panic, causing the system to crash.
This issue could be exploited by an unprivileged attacker to crash a system to which they have local access. It should be noted that under default FreeBSD 5.x kernels, it may be possible for an attacker to exploit this issue in such a way as to execute arbitrary code with root privileges.
Exploit / POC
FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
References:
References: