NetBSD Sysctl Argument Handling Vulnerabilities
BID:8643
Info
NetBSD Sysctl Argument Handling Vulnerabilities
| Bugtraq ID: | 8643 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 18 2003 12:00AM |
| Updated: | Sep 18 2003 12:00AM |
| Credit: | These issues were announced by the vendor. |
| Vulnerable: |
NetBSD NetBSD 1.6.1 NetBSD NetBSD 1.6 NetBSD NetBSD 1.5.3 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 |
| Not Vulnerable: | |
Discussion
NetBSD Sysctl Argument Handling Vulnerabilities
Multiple vulnerabilities have been reported in the sysctl system call for NetBSD systems.
A kernel panic could be the result of some sysctl nodes attempting to dereference a NULL pointer. This could potentially be triggered by a local user.
If the process ID of a zombie process is passed to the system call, this would cause invalid process information to be dereferenced, also resulting in a kernel panic.
Some sysctl nodes do not implement sufficient range checking, potentially allowing kernel memory to be read. This issue may be similar to the vulnerability described in BID 2364, which affects the Linux kernel.
It is not known if other BSD derivatives are similarly affected by these issues.
Multiple vulnerabilities have been reported in the sysctl system call for NetBSD systems.
A kernel panic could be the result of some sysctl nodes attempting to dereference a NULL pointer. This could potentially be triggered by a local user.
If the process ID of a zombie process is passed to the system call, this would cause invalid process information to be dereferenced, also resulting in a kernel panic.
Some sysctl nodes do not implement sufficient range checking, potentially allowing kernel memory to be read. This issue may be similar to the vulnerability described in BID 2364, which affects the Linux kernel.
It is not known if other BSD derivatives are similarly affected by these issues.
Exploit / POC
NetBSD Sysctl Argument Handling Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
NetBSD Sysctl Argument Handling Vulnerabilities
Solution:
NetBSD has released an advisory to address this issue. The advisory contains details about how to obtain revisions to upgrade the kernel. Please see the advisory for further details. It should also be noted that NETBSD-current source prior to August 25, 2003 is prone to this issue.
Solution:
NetBSD has released an advisory to address this issue. The advisory contains details about how to obtain revisions to upgrade the kernel. Please see the advisory for further details. It should also be noted that NETBSD-current source prior to August 25, 2003 is prone to this issue.
References
NetBSD Sysctl Argument Handling Vulnerabilities
References:
References: