From owner-freebsd-security Wed Jan 8 8:25:23 2003 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CE47837B401 for ; Wed, 8 Jan 2003 08:25:19 -0800 (PST) Received: from post-20.mail.nl.demon.net (post-20.mail.nl.demon.net [194.159.73.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1EE3543E4A for ; Wed, 8 Jan 2003 08:25:19 -0800 (PST) (envelope-from apehaar@text-only.demon.nl) Received: from [212.238.193.97] (helo=JOS) by post-20.mail.nl.demon.net with smtp (Exim 3.36 #1) id 18WJ13-000GRQ-00; Wed, 08 Jan 2003 16:25:18 +0000 Message-ID: <004101c2b732$89d59940$0201a8c0@JOS> From: "horcy" To: "budsz" Cc: References: <20030108162158.GC48296@kumprang.or.id> Subject: Re: [security-advisories@freebsd.org: FreeBSD Security Advisory FreeBSD-SA-02:44.filedesc] Date: Wed, 8 Jan 2003 17:25:20 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org II. Problem Description A programming error in the fpathconf system call can result in the given file descriptor's reference count being erroneously incremented. A similar problem exists in the developer preview versions of FreeBSD 5.0, affecting the lseek(2), dup(2), and other system calls. III. Impact A local attacker may cause the operating system to crash by repeatedly calling fpathconf on a file descriptor until the reference count wraps to a negative value, and then calling close on that file descriptor. Similarly, it may be possible to cause a file descriptor to reference unallocated kernel memory, but remain valid. If a new file is later opened and the kernel allocates the new file structure at the same memory location, then an attacker may be able to gain read or write access to that file. This may in turn lead to privilege escalation. IV. Workaround There is no workaround. V. Solution The following patch has been verified to apply to FreeBSD 4.4, 4.5, 4.6, and 4.7 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. The question: If I periodicly upgrade with cvsup stable and compile kernel it's will fix that problem, or I must patch only. does cvsup will replace all of source? --------------------------- Answer: if you cvsup to stable it will fix it and of course the patch will fix it. But you still have to recompile you kernel, so to if it was time for your cvsup stable then i sould suggest you do that. Both will take some time. So i would go for the cvsup. l8r horcy -- budsz To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message