Date: Wed, 5 Jul 2017 11:22:22 +0100 From: Matthew Seaman <matthew@FreeBSD.org> To: freebsd-questions@freebsd.org Subject: Re: CVE-2017-1000364 FreeBSD exposure ? Message-ID: <7860b23a-66ce-1bc6-b5f6-9264057bdf23@FreeBSD.org> In-Reply-To: <CAE63ME6r-t=xN=X%2BoCBrYfFruwir9djkMoheCXwbX8QR0mz8Aw@mail.gmail.com> References: <CAE63ME6r-t=xN=X%2BoCBrYfFruwir9djkMoheCXwbX8QR0mz8Aw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --h4FNrVCRGiT9geMmDVGCJLCpCIlFCR1Vv Content-Type: multipart/mixed; boundary="opsLRtEaSm6ec2qPcw9HeQTueE6lj0Op9"; protected-headers="v1" From: Matthew Seaman <matthew@FreeBSD.org> To: freebsd-questions@freebsd.org Message-ID: <7860b23a-66ce-1bc6-b5f6-9264057bdf23@FreeBSD.org> Subject: Re: CVE-2017-1000364 FreeBSD exposure ? References: <CAE63ME6r-t=xN=X+oCBrYfFruwir9djkMoheCXwbX8QR0mz8Aw@mail.gmail.com> In-Reply-To: <CAE63ME6r-t=xN=X+oCBrYfFruwir9djkMoheCXwbX8QR0mz8Aw@mail.gmail.com> --opsLRtEaSm6ec2qPcw9HeQTueE6lj0Op9 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 2017/07/05 10:55, Damien Fleuriot wrote: > I'm curious about the lack of announcement on the site in the > vulnerabilities section [1], about CVE-2017-1000364 [2] [3]. >=20 >=20 > Does anyone know to what extent FreeBSD is affected ? >=20 > I'm trying to assess how critical it is that I patch our FreeBSD > 10-STABLE boxes at work. >=20 >=20 >=20 > Hope a kind soul can spare 5 minutes of their precious time to shed > some light for me ;) The Security Team and a number of Kernel developers have examined the stack-clash exploit and how it would apply to FreeBSD, and have concluded that on FreeBSD it does not pose a vulnerability that would merit a security advisory. While it is possible to write an application to generate a stack-clash relatively simply. According to Qualys' work, in order to be exploitable, this requires a particular type of vulnerability in a setuid or setgid application where a stack-clash can be generated. As far as they could determine, no such combination could be found. Stack-clash is definitely a bug, and there is on-going work to tighten up the way stack and heap collisions are handled which has recently been committed to CURRENT and will be MFC'd to STABLE branches in the usual way. There may well be an Errata Notification on the currently supported -RELEASE branches in order to address the widespread public concerns. However, to the best of SecTeam's knowledge this is not a critical problem on FreeBSD. Of course, this does not preclude an exploit using some ported software -- if anyone is aware of any such exploit, please let SecTeam know as soon as possible. Cheers, Matthew --opsLRtEaSm6ec2qPcw9HeQTueE6lj0Op9-- --h4FNrVCRGiT9geMmDVGCJLCpCIlFCR1Vv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQJ8BAEBCgBmBQJZXL3kXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxOUYxNTRFQ0JGMTEyRTUwNTQ0RTNGMzAw MDUxM0YxMEUwQTlFNEU3AAoJEABRPxDgqeTnpVkP/RmqBAMsybJNSGPn1QHUWk8p eJXBG6Je/7Ysi+rhgO+ZJTEiJshcGyk6hb+0u738goNlKpvfiX/+2l1LXnAoIY9I 53cqTFPVJ4nL4LkLoF+dwSClGJzAxTAI8R5WGgFR5FY0M6pvAU2wMz4v33sKdCBq L4suVsBsZtjuN/jqHlbZfVn008rLXIgvhVHDxg25C8kh/pidaOrILuUFGCwTuWva iJh45psjuuvROAaDb0GD70BOkgCsaYvqaggQ/0pchU8Xreo7HwiTzHi84o9acYLu rCln1PBt9JFyzL0fYs5gs48Z5jPiVV+Ydv15CZHAxoMZ+2ERS0qrrWlUaSxqtL9B YzNJn1xCuZ9sSiNNqkWU9exac/5zmdwBOuioQwN6Bevmr8aE2fsLHMgvTrmLHMYC qMacbM7QOvw19I/3HuZ2qO9jMUhpbQ8XAZu6o3TcqY2VcrHm9gSyzKhMF6uMAgcC TRJhgndejKaX4KFxp8Kpckt1nRETprdkMFI+5q67q0wmNkHpgeu31kQoehSCJiqF HfFVQXFp1fW5hOx0Onm4feH363Of4LOA+BKFz0w3HXrZ3M6C4Me/ZJR7/W6qLFyp ezaxI+nPhiat+2cxpm2xecZdo82lQXRpHvWoOIztHqEBm1LDlnSaZoy9c1ZRsN3y alLjQLtpnRFry3mOWUrQ =RyFX -----END PGP SIGNATURE----- --h4FNrVCRGiT9geMmDVGCJLCpCIlFCR1Vv--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?7860b23a-66ce-1bc6-b5f6-9264057bdf23>