-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
		 NetBSD Security Advisory 2005-003

		 =================================
Topic:		F_CLOSEM local denial of service
Version:	NetBSD-current:	source prior to January 12, 2005

		NetBSD 2.1:	not affected

		NetBSD 2.0.2:	not affected

		NetBSD 2.0:	affected

		NetBSD 1.6.*:	not affected
Severity:	Local Denial-of-Service
Fixed:		NetBSD-current:		January 12, 2005

		NetBSD-2-0 branch:	March 16, 2005

						(2.0.2 includes the fix)

		NetBSD-2 branch:	March 16, 2005

						(2.1 includes the fix)
Abstract

========
A bug in the way the file descriptor table of a process is manipulated

can be triggered by calling the F_CLOSEM fnctl() with the parameter 0,

which means "close all opened file descriptors".
The result of the bug is that the kernel will loop endlessly,

effectively locking up the computer.
Any local user can trigger the bug.
Technical Details

=================
The F_CLOSEM fnctl() call takes a parameter and makes the kernel close

all file descriptors of the process whose number is greater or equal to

the parameter.
fd_lastfile in the process's descriptor table keeps track of the last file

descriptor index used by the process, and its value is maintained by

find_last_set(). A change in find_last_set() that made it return 0 and not

- -1 (like it used to) when no files were used caused an infinite loop in

the kernel, leading to local denial-of-service triggerable by any user.
Solutions and Workarounds

=========================
There is no workaround for this issue. It is recommended that users of

affected NetBSD versions upgrade their kernel.
The following instructions describe how to upgrade your kernel by updating

your source tree and rebuilding and installing a new version of the

kernel.
* NetBSD-current:
	Systems running NetBSD-current dated from before 2005-01-12

	should be upgraded to NetBSD-current dated 2005-01-13 or later.
	The following files need to be updated from the

	netbsd-current CVS branch (aka HEAD):

		sys/kern/kern_descrip.c
	To update from CVS, re-build, and re-install the kernel:
		# cd src

		# cvs update -d -P sys/kern/kern_descrip.c

		# ./build.sh kernel=GENERIC

		# mv /netbsd /netbsd.old

		# cp sys/arch/`machine`/compile/obj/GENERIC/netbsd /netbsd

		# shutdown -r now
* NetBSD 2.0:
	The binary distribution of NetBSD 2.0 is vulnerable.
	NetBSD 2.1 includes the fix.
	Systems running NetBSD 2.0 sources dated from before

	2005-01-12 should be upgraded from NetBSD 2.0 sources dated

	2005-01-13 or later.
	The following files need to be updated from the

	netbsd-2-0 CVS branch:

		sys/kern/kern_descrip.c
	To update from CVS, re-build, and re-install the kernel:
		# cd src

		# cvs update -d -P -r netbsd-2-0 sys/kern/kern_descrip.c

		# ./build.sh kernel=GENERIC

		# mv /netbsd /netbsd.old

		# cp sys/arch/`machine`/compile/obj/GENERIC/netbsd /netbsd

		# shutdown -r now
Thanks To

=========
Brian Marcotte, for discovering and reporting the issue.
Greg Oster and Quentin Garnier, for analysis and fixes.
Revision History

================
	2005-10-31	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2005-003.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2005, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2005-003.txt,v 1.10 2005/10/31 19:11:45 gendalia Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.2 (NetBSD)
iQCVAwUBQ2fKRj5Ru2/4N2IFAQKyJQP/cF9a8IM4ayqS2nNv0HPgL4uPvbmnHPDW

F76FTxFDfrImmkMNrdIBaj/1B/LS41+iMWTJJFGWNkqZjzXKVLuD7/rLDKGjI1Aa

WfmS7gHoZcI5p5A0x+RFtOM399sQX2/cC5a0hcGamKncBChKMNEdn3u//q/HC+4e

rpQReunJrFU=

=SfoJ

-----END PGP SIGNATURE-----