From owner-freebsd-announce@FreeBSD.ORG Mon Jun 18 17:33:55 2012 Return-Path: Delivered-To: freebsd-announce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id A88671065709 for ; Mon, 18 Jun 2012 17:33:55 +0000 (UTC) (envelope-from deb@freebsdfoundation.org) Received: from aslan.scsiguy.com (aslan.scsiguy.com [70.89.174.89]) by mx1.freebsd.org (Postfix) with ESMTP id 5EFBA8FC1D for ; Mon, 18 Jun 2012 17:33:55 +0000 (UTC) Received: from Deb-Goodkins-MacBook-Pro.local (c-71-196-153-166.hsd1.co.comcast.net [71.196.153.166]) (authenticated bits=0) by aslan.scsiguy.com (8.14.5/8.14.5) with ESMTP id q5IHXsoZ065381 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Mon, 18 Jun 2012 11:33:54 -0600 (MDT) (envelope-from deb@freebsdfoundation.org) Message-ID: <4FDF667D.90609@freebsdfoundation.org> Date: Mon, 18 Jun 2012 11:33:49 -0600 From: Deb Goodkin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: freebsd-announce@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (aslan.scsiguy.com [70.89.174.89]); Mon, 18 Jun 2012 11:33:54 -0600 (MDT) X-Mailman-Approved-At: Mon, 18 Jun 2012 17:59:37 +0000 Subject: [FreeBSD-Announce] Foundation Announces Capsicum Project! X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 17:33:55 -0000 Dear FreeBSD Community, The FreeBSD Foundation is pleased to announce that Pawel Jakub Dawidek has been awarded a grant to develop a comprehensive userspace framework for writing Capsicum-based applications, building on the kernel features originally developed by the University of Cambridge and Google Research. This framework will include a Capsicum runtime linker and component library providing sandboxed versions of key higher-level system libraries. Components will both be sandboxed, improving resistance to vulnerabilities, and also easily available for delegation to sandboxed applications, such as the Chromium web browser. The prototype libcapsicum developed by Cambridge will be analyzed and updated based on lessons learned in implementing Capsicumised software packages, such as hastd and auditdistd. Funding for this project will be provided by the FreeBSD Foundation matched 100% by the Google Open Source Program Office, in support of open source technology transition of Capsicum. "A continuing challenge in security is to find solutions that not only fix the problems but also can be applied to existing technologies: attractive though the notion is, we are not going to persuade the world to rewrite everything! This is why we at Google are pleased and excited to support the continuing development of Capsicum, which radically improves the security of UNIX based systems whilst allowing a continuous migration path from today's mechanisms to tomorrow's," said Ben Laurie, Google Senior Staff Software Engineer. "I'm very excited to be able to work on Capsicum. Some of my software is already using Capsicum, so I'm fully aware of the great potential of this framework. This technology is so much superior than the current attempts to provide sandboxing using tools like chroot(2) or unprivileged user credentials. No matter how corny it sounds, I strongly believe Capsicum can make the Internet a safer place." said Pawel. This project will conclude in August, 2012 The FreeBSD Foundation From owner-freebsd-announce@FreeBSD.ORG Tue Jun 19 14:35:37 2012 Return-Path: Delivered-To: freebsd-announce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 18CBE106566C; Tue, 19 Jun 2012 14:35:37 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 009C28FC16; Tue, 19 Jun 2012 14:35:37 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q5JEZaBd006644; Tue, 19 Jun 2012 14:35:36 GMT (envelope-from security-advisories@freebsd.org) Received: (from simon@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q5JEZaTZ006642; Tue, 19 Jun 2012 14:35:36 GMT (envelope-from security-advisories@freebsd.org) Date: Tue, 19 Jun 2012 14:35:36 GMT Message-Id: <201206191435.q5JEZaTZ006642@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: simon set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Cc: Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-12:04.sysret [REVISED] X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.5 Reply-To: freebsd-security@freebsd.org List-Id: "Project Announcements \[moderated\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jun 2012 14:35:37 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-12:04.sysret Security Advisory The FreeBSD Project Topic: Privilege escalation when returning from kernel Category: core Module: sys_amd64 Announced: 2012-06-12 Credits: Rafal Wojtczuk, John Baldwin Affects: All supported versions of FreeBSD Corrected: 2012-06-12 12:10:10 UTC (RELENG_7, 7.4-STABLE) 2012-06-12 12:10:10 UTC (RELENG_7_4, 7.4-RELEASE-p9) 2012-06-12 12:10:10 UTC (RELENG_8, 8.3-STABLE) 2012-06-12 12:10:10 UTC (RELENG_8_3, 8.3-RELEASE-p3) 2012-06-12 12:10:10 UTC (RELENG_8_2, 8.2-RELEASE-p9) 2012-06-18 21:00:54 UTC (RELENG_8_1, 8.1-RELEASE-p12) 2012-06-12 12:10:10 UTC (RELENG_9, 9.0-STABLE) 2012-06-12 12:10:10 UTC (RELENG_9_0, 9.0-RELEASE-p3) CVE Name: CVE-2012-0217 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . 0. Revision History v1.0 2012-06-12 Initial release. v1.1 2012-06-19 Corrected patch FreeBSD 8.1. I. Background The FreeBSD operating system implements a rings model of security, where privileged operations are done in the kernel, and most applications request access to these operations by making a system call, which puts the CPU into the required privilege level and passes control to the kernel. II. Problem Description FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call. III. Impact Successful exploitation of the problem can lead to local kernel privilege escalation, kernel data corruption and/or crash. To exploit this vulnerability, an attacker must be able to run code with user privileges on the target system. IV. Workaround No workaround is available. However FreeBSD/amd64 running on AMD CPUs is not vulnerable to this particular problem. Systems with 64 bit capable CPUs, but running the 32 bit FreeBSD/i386 kernel are not vulnerable, nor are systems running on different processor architectures. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 7-STABLE, 8-STABLE, or 9-STABLE, or to the RELENG_7_4, RELENG_8_3, RELENG_8_2, RELENG_8_1, or RELENG_9_0 security branch dated after the correction date. 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to FreeBSD 7.4, 8.3, 8.2, 8.1 and 9.0 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [7.4, 8.3, 8.2, 9.0] # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret.patch # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret.patch.asc [8.1] # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret-81.patch # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret-81.patch.asc [8.1 if original sysret.patch has been applied] # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret-81-correction.patch # fetch http://security.FreeBSD.org/patches/SA-12:04/sysret-81-correction.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. 3) To update your vulnerable system via a binary patch: Systems running 7.4-RELEASE, 8.3-RELEASE, 8.2-RELEASE, 8.1-RELEASE, or 9.0-RELEASE on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. CVS: Branch Revision Path - ------------------------------------------------------------------------- RELENG_7 src/sys/amd64/amd64/trap.c 1.319.2.14 RELENG_7_4 src/UPDATING 1.507.2.36.2.11 src/sys/conf/newvers.sh 1.72.2.18.2.14 src/sys/amd64/amd64/trap.c 1.319.2.12.2.2 RELENG_8 src/sys/amd64/amd64/trap.c 1.332.2.24 RELENG_8_3 src/UPDATING 1.632.2.26.2.5 src/sys/conf/newvers.sh 1.83.2.15.2.7 src/sys/amd64/amd64/trap.c 1.332.2.21.2.2 RELENG_8_2 src/UPDATING 1.632.2.19.2.11 src/sys/conf/newvers.sh 1.83.2.12.2.14 src/sys/amd64/amd64/trap.c 1.332.2.14.2.2 RELENG_8_1 src/UPDATING 1.632.2.14.2.15 src/sys/conf/newvers.sh 1.83.2.10.2.16 src/sys/amd64/amd64/trap.c 1.332.2.10.2.3 RELENG_9 src/sys/amd64/amd64/trap.c 1.357.2.9 RELENG_9_0 src/UPDATING 1.702.2.4.2.5 src/sys/conf/newvers.sh 1.95.2.4.2.7 src/sys/amd64/amd64/trap.c 1.357.2.2.2.3 - ------------------------------------------------------------------------- Subversion: Branch/path Revision - ------------------------------------------------------------------------- stable/7/ r236953 releng/7.4/ r236953 stable/8/ r236953 releng/8.3/ r236953 releng/8.2/ r236953 releng/8.1/ r237242 stable/9/ r236953 releng/9.0/ r236953 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217 The latest revision of this advisory is available at http://security.FreeBSD.org/advisories/FreeBSD-SA-12:04.sysret.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 iEYEARECAAYFAk/gjHQACgkQFdaIBMps37KutQCgkcp+lqFuJ3/fQKUemn80suW5 u/wAn2VLxY5LoUPNsN2eUHYB4GMz0AHl =tQOk -----END PGP SIGNATURE-----