From owner-freebsd-announce@FreeBSD.ORG Wed Apr 6 01:11:58 2005 Return-Path: Delivered-To: freebsd-announce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7A68716A4CF; Wed, 6 Apr 2005 01:11:58 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8633943D5C; Wed, 6 Apr 2005 01:11:57 +0000 (GMT) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (cperciva@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j361BvHF096075; Wed, 6 Apr 2005 01:11:57 GMT (envelope-from security-advisories@freebsd.org) Received: (from cperciva@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j361BvD3096073; Wed, 6 Apr 2005 01:11:57 GMT (envelope-from security-advisories@freebsd.org) Date: Wed, 6 Apr 2005 01:11:57 GMT Message-Id: <200504060111.j361BvD3096073@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: cperciva set sender to security-advisories@freebsd.org using -f From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-05:03.amd64 X-BeenThere: freebsd-announce@freebsd.org X-Mailman-Version: 2.1.1 Reply-To: security-advisories@freebsd.org List-Id: Project Announcements [moderated] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Apr 2005 01:11:58 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:03.amd64 Security Advisory The FreeBSD Project Topic: unprivileged hardware access on amd64 Category: core Module: sys_amd64 Announced: 2004-04-06 Credits: Jari Kirma Affects: All FreeBSD/amd64 5.x releases prior to 5.4-RELEASE Corrected: 2005-04-06 01:05:51 UTC (RELENG_5, 5.4-STABLE) 2005-04-06 01:06:15 UTC (RELENG_5_4, 5.4-RELEASE) 2005-04-06 01:06:44 UTC (RELENG_5_3, 5.3-RELEASE-p8) For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The AMD64 architecture has two mechanisms for permitting processes to access hardware: Kernel code can access hardware directly by reason of its elevated privilege level, while user code can access a subset of hardware determined by a bitmap. II. Problem Description The bitmap which determines which hardware can be accessed by unprivileged processes was not initialized properly. III. Impact Unprivileged users on amd64 systems can gain direct access to some hardware, allowing for denial of service, disclosure of sensitive information, or possible privilege escalation. IV. Workaround No workaround is known for amd64 systems; other platforms are not affected by this issue. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: a) Download the patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:03/amd64.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:03/amd64.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/sys/amd64/amd64/machdep.c 1.618.2.10 src/sys/amd64/amd64/mp_machdep.c 1.242.2.8 src/sys/amd64/include/tss.h 1.16.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.2 src/sys/amd64/amd64/machdep.c 1.618.2.9.2.1 src/sys/amd64/amd64/mp_machdep.c 1.242.2.7.2.1 src/sys/amd64/include/tss.h 1.16.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.11 src/sys/conf/newvers.sh 1.62.2.15.2.13 src/sys/amd64/amd64/machdep.c 1.618.2.1.2.1 src/sys/amd64/amd64/mp_machdep.c 1.242.2.2.2.1 src/sys/amd64/include/tss.h 1.16.4.1 - ------------------------------------------------------------------------- The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:03.amd64.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFCUzaUFdaIBMps37IRAnRFAJ9jtpE43eTtfUyK+x8RhurMG4PpcQCfbfYM gptRJSrN9EmQ/cDgo6Xoank= =ocq1 -----END PGP SIGNATURE-----