NetBSD ptrace(2) Vulnerability
BID:992
Info
NetBSD ptrace(2) Vulnerability
| Bugtraq ID: | 992 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 12 1999 12:00AM |
| Updated: | Dec 12 1999 12:00AM |
| Credit: | This vulnerability was first made public in a NetBSD Security Advisory dated December 12, 1999. |
| Vulnerable: |
NetBSD NetBSD 1.4.1 x86 NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 |
| Not Vulnerable: | |
Discussion
NetBSD ptrace(2) Vulnerability
A vulnerability exists in the vax version of NetBSD, up to and including 1.4.1, and -current branches prior to 1991212. The ptrace() system call is used to trace and debug processes. The debugging process can alter register values, including the PSL (status) register. Under the VAX architecture, information about privilege levels and used stacks are also stored in the PSL register. Those flags are altered via the REI instruction (return from interrupt) or LDPCTX (load process context) instruction, and cannot be modified in 'user' mode. When altering the PSL from a debugging process, however, the program is in a kernel mode, and the debugging process can effectively alter the PSL to increase the privilege of the process.
A vulnerability exists in the vax version of NetBSD, up to and including 1.4.1, and -current branches prior to 1991212. The ptrace() system call is used to trace and debug processes. The debugging process can alter register values, including the PSL (status) register. Under the VAX architecture, information about privilege levels and used stacks are also stored in the PSL register. Those flags are altered via the REI instruction (return from interrupt) or LDPCTX (load process context) instruction, and cannot be modified in 'user' mode. When altering the PSL from a debugging process, however, the program is in a kernel mode, and the debugging process can effectively alter the PSL to increase the privilege of the process.
Solution / Fix
NetBSD ptrace(2) Vulnerability
Solution:
Current versions of the NetBSD tree (-current) are not vulnerable. If you are running a kernel built from sources prior to 12/12/99, on VAX hardware, you should upgrade immediately.
The following patch can be applied to 1.4.1 kernels:
Index: machdep.c
===================================================================
RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v
retrieving revision 1.76.2.1
diff -c -r1.76.2.1 machdep.c
*** machdep.c 1999/04/16 16:26:01 1.76.2.1
- --- machdep.c 1999/12/12 11:08:46
***************
*** 770,776 ****
tf->fp = regs->fp;
tf->sp = regs->sp;
tf->pc = regs->pc;
! tf->psl = regs->psl;
return 0;
}
- --- 770,777 ----
tf->fp = regs->fp;
tf->sp = regs->sp;
tf->pc = regs->pc;
! tf->psl = (regs->psl|PSL_U|PSL_PREVU) &
! ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */
return 0;
}
Solution:
Current versions of the NetBSD tree (-current) are not vulnerable. If you are running a kernel built from sources prior to 12/12/99, on VAX hardware, you should upgrade immediately.
The following patch can be applied to 1.4.1 kernels:
Index: machdep.c
===================================================================
RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v
retrieving revision 1.76.2.1
diff -c -r1.76.2.1 machdep.c
*** machdep.c 1999/04/16 16:26:01 1.76.2.1
- --- machdep.c 1999/12/12 11:08:46
***************
*** 770,776 ****
tf->fp = regs->fp;
tf->sp = regs->sp;
tf->pc = regs->pc;
! tf->psl = regs->psl;
return 0;
}
- --- 770,777 ----
tf->fp = regs->fp;
tf->sp = regs->sp;
tf->pc = regs->pc;
! tf->psl = (regs->psl|PSL_U|PSL_PREVU) &
! ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */
return 0;
}