OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
BID:9086
Info
OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
| Bugtraq ID: | 9086 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 21 2003 12:00AM |
| Updated: | Nov 21 2003 12:00AM |
| Credit: | This vulnerability was initially reported in the OpenBSD eratta. |
| Vulnerable: |
OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 |
| Not Vulnerable: | |
Discussion
OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
A local OpenBSD kernel vulnerability has been discovered when handling the semctl and semop system calls. The problem specifically occurs due to improper sanity checking before handling a user-supplied semaphore set. It is said that this could lead to the corruption of kernel-based memory and may result in a kernel panic.
The problem occurs due to the affected code verifying the bounds of an integer against an incorrect variable. This could result in an unintended index into an array situated in heap memory. The value taken from the location within the array is interpreted as a pointer and later dereferenced. If a value believed to be a legitimate memory address were used, this would effectively result in a segmentation violation within the kernel, causing it to panic.
Although unconfirmed, due to the nature of this issue it has been speculated that this issue could be exploited to gain elevated system privileges.
A local OpenBSD kernel vulnerability has been discovered when handling the semctl and semop system calls. The problem specifically occurs due to improper sanity checking before handling a user-supplied semaphore set. It is said that this could lead to the corruption of kernel-based memory and may result in a kernel panic.
The problem occurs due to the affected code verifying the bounds of an integer against an incorrect variable. This could result in an unintended index into an array situated in heap memory. The value taken from the location within the array is interpreted as a pointer and later dereferenced. If a value believed to be a legitimate memory address were used, this would effectively result in a segmentation violation within the kernel, causing it to panic.
Although unconfirmed, due to the nature of this issue it has been speculated that this issue could be exploited to gain elevated system privileges.
Exploit / POC
OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
A proof of concept exploit has been made available by Noir.
A proof of concept exploit has been made available by Noir.
Solution / Fix
OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
Solution:
OpenBSD has released patches to address this issue in the 3.3 and 3.4 releases.
OpenBSD OpenBSD 3.4
OpenBSD OpenBSD 3.3
Solution:
OpenBSD has released patches to address this issue in the 3.3 and 3.4 releases.
OpenBSD OpenBSD 3.4
-
OpenBSD 008_sem.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/008_sem.patch
OpenBSD OpenBSD 3.3
-
OpenBSD 013_sem.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/013_sem.patch
References
OpenBSD semctl/semop Local Unexpected Array Indexing Vulnerability
References:
References:
- OpenBSD 3.3 release errata & patch list (OpenBSD)
- OpenBSD 3.4 release errata & patch list (OpenBSD)
- OpenBSD Homepage (OpenBSD)
- yet another panic() in OpenBSD ([email protected])