From owner-freebsd-security Sun Aug 11 14:47:29 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 39D8337B400 for ; Sun, 11 Aug 2002 14:47:26 -0700 (PDT) Received: from obsecurity.dyndns.org (adsl-67-115-73-77.dsl.lsan03.pacbell.net [67.115.73.77]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8A0B643E5E for ; Sun, 11 Aug 2002 14:47:25 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 3E60566DDD; Sun, 11 Aug 2002 14:47:24 -0700 (PDT) Date: Sun, 11 Aug 2002 14:47:23 -0700 From: Kris Kennaway To: security@freebsd.org Subject: [provos@citi.umich.edu: OpenBSD Security Advisory: Select Boundary Condition] Message-ID: <20020811214723.GA76470@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org In case anyone is wondering, it looks like FreeBSD fixed this security hole 6 years ago, in the following commit: --- Revision 1.19 / (download) - annotate - [select for diffs], Tue Aug 20 07:17:48 1996 UTC (5 years, 11 months ago) by smpatel Branch: MAIN Changes since 1.18: +43 -15 lines Diff to previous 1.18 (colored) Remove the kernel FD_SETSIZE limit for select(). Make select()'s first argument 'int' not 'u_int'. Reviewed by: bde --- Kris ----- Forwarded message from Niels Provos ----- OpenBSD Security Advisory (adv.select) Original Release Date: 2002-08-11 1. Systems affected: All versions of OpenBSD. 2. Overview: Insufficient boundary checks in the select call allow an attacker to overwrite kernel memory and execute arbitrary code in kernel context. Traditionally, the size parameter for the select system call is a signed integer. As a result, the kernel evaluates the upper boundary checks in a signed context, so that an attacker can circumvent when using certain negative values. When the kernel copies the data for the select system call from userland the size is used as an unsigned integer which causes kernel memory to be overwritten with arbitrary data. 2. Impact: Local users can obtain complete system privileges and circumvent the extra security measures provided by the securelevel system. 3. Solution: Apply one of the supplied kernel patches or update to 3.0-stable or 3.1-stable from 2002-08-11 17:00 EDT or later. 4. Patch: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch ----- End forwarded message ----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message