-----BEGIN PGP SIGNED MESSAGE-----
		 NetBSD Security Advisory 2004-010

		 =================================
Topic:		Insufficient argument validation in compat code
Version:	NetBSD-current:	source prior to Oct 27, 2004

		NetBSD 2.0:	not affected

		NetBSD 1.6.2:	affected

		NetBSD 1.6.1:	affected

		NetBSD 1.6:	affected

		NetBSD 1.5.3:	affected

		NetBSD 1.5.2:	affected

		NetBSD 1.5.1:	affected

		NetBSD 1.5:	affected
Severity:	Local Denial of Service

		possible Local Privilege Escalation
Fixed:		NetBSD-current:		Oct 28, 2004

		NetBSD-2.0 branch:	Nov 13, 2004 (2.0 includes the fix)

		NetBSD-1.6 branch:	Dec 17, 2004 (1.6.3 will include the fix)
Abstract

========
Kernel syscall implementations must perform appropriate sanity checks on

data passed from userland. The native system calls perform appropriate

checks.
Some of the functions in /usr/src/sys/compat/* which implement execution

of foreign binaries (such as Linux, FreeBSD, IRIX, OSF1, SVR4, HPUX, and

ULTRIX) used argument data in unsafe ways prior to calling the kernel

syscall.
This issue was reported by Evgeny Demidov.
Technical Details

=================
The compat subsystem, in /usr/src/sys/compat/*, allows NetBSD users to

run binaries compiled for other operating systems which run on the same

CPU architecture as the NetBSD host.
Typically, the foreign OS supports a set of system calls which are very

similar to NetBSD's. Native instructions do not need to be translated,

but calls to the operating system do.
A binary's native OS is determined at exec() time. The kernel maps the

syscall table for the native OS so that each syscall is delivered to a

foreign OS -> NetBSD translation function, if needed.
These translation functions reorder arguments, reformat them, perform

mapping of constants (such as signal(3) IDs) and call the appropriate

native NetBSD system call to service the application's needs.
Some of the translation functions performed unsafe operations using the

syscall arguments, and were exploitable to cause kernel traps. Some of

the flaws may be exploitable and result in privilege escalation.
All of these attacks require local access to the system. A system with

only trusted user accounts is not immediately at risk.
A system running a custom kernel with all 'options COMPAT_' commented

out is not at risk.
See also Evgeny Demidov's advisory:
http://gleg.net/advisory_netbsd2.shtml
Solutions and Workarounds

=========================
The NetBSD 2.0 release already includes the fixes for this

vulnerability.
Since the NetBSD-1-5 branch has reached End of Life, updating to

NetBSD-1-6 or NetBSD-2-0 is recommended.
netbsd-1-6, netbsd-2-0 (pre-release), netbsd-current:
*** Patching from sources:
The fix for this issue is contained in changes to several files, all

within the subdirectory:
	sys/compat
The following instructions describe how to upgrade your kernel

binaries by updating your source tree and rebuilding and installing a

new version of the kernel. In these instructions, replace:
  BRANCH   with the appropriate CVS branch (netbsd-1-6,

		  netbsd-2-0, HEAD)

  ARCH     with your architecture (from uname -m), and

  KERNCONF with the name of your kernel configuration file.
To update from CVS, re-build and re-install the kernel:
        # cd src

        # cvs update -d -P -r BRANCH sys/compat

        # cd sys/arch/ARCH/conf

        # config KERNCONF

        # cd ../compile/KERNCONF

        # make depend; make

        # mv /netbsd /netbsd.old

        # cp netbsd /

        # shutdown -fr now
Thanks To

=========
Evgeny Demidov for notification, review of patches, and considerable patience.
Christos Zoulas, David Maxwell, and Simon Burge for patches and review.
Revision History

================
	2004-12-16	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-010.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2004, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2004-010.txt,v 1.3 2004/12/16 16:12:27 david Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.4 (NetBSD)
iQCVAwUBQcG0RT5Ru2/4N2IFAQGEsAQAolCepbv3R/7v5AEpv2o6yuULRnSIqpzR

efeKgmi/pSx3Nqxyb1SnW7C7gdvhIzqrhwZV0Hw/iiWo/A7SSQ8+Oht7wdADT1PO

YOBLu3+7zwBsY4Hgh/v5e6khzTqLrMzUg52G2ulrUAjrrCKIZwO3J0YKEEkeO/7q

43+wG6nEH9M=

=KnM+

-----END PGP SIGNATURE-----