Home » Mailing list archives » netbsd-announce » 2006 » April » 12

NetBSD Security Advisory 2006-012: SIOCGIFALIAS ioctl may cause system crash

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: NetBSD Security-Officer <security-officer@...>
Subject: NetBSD Security Advisory 2006-012: SIOCGIFALIAS ioctl may cause system crash
Date: Wednesday, April 12, 2006 - 10:34 pm

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1


		 NetBSD Security Advisory 2006-012

		 =================================


Topic:		SIOCGIFALIAS ioctl may cause system crash


Version:	NetBSD-current:	source prior to September 28, 2005

		NetBSD 3.0:	affected

		NetBSD 2.1:     affected

		NetBSD 2.0.*:   affected

		NetBSD 2.0:     affected

		NetBSD 1.6.*:   affected

		NetBSD 1.6:     affected


Severity:	Any local user can crash the system


Fixed:		NetBSD-current:		September 28, 2005

		NetBSD-3-0 branch:	April 02, 2006

						(3.0.1 will include the fix)

		NetBSD-3   branch:	April 02, 2006

		NetBSD-2-1 branch:	April 02, 2006

						(2.1.1 will include the fix)

		NetBSD-2-0 branch:	April 02, 2006

						(2.0.4 will include the fix)

		NetBSD-2 branch:	April 02, 2006

		NetBSD-1-6 branch:	April 02, 2006


Abstract

========


A system crash can occur if a user attempts to gather information on a

non-existent alias of a network interface via the SIOCGIFALIAS ioctl.


Technical Details

=================


A NULL dereference occurs in the kernel when the alias in question

was not located, rather than returning an error.  A socket on the

local machine is required.


Solutions and Workarounds

=========================


For all NetBSD versions, you need to obtain fixed kernel sources,

rebuild and install the new kernel, and reboot the system.


The fixed source may be obtained from the NetBSD CVS repository.


The following instructions briefly summarise how to upgrade your

kernel.  In these instructions, replace:


  ARCH     with your architecture (from uname -m), and

  KERNCONF with the name of your kernel configuration file.


To update from CVS, re-build, and re-install the kernel:


        # cd src

        # cvs update -d -P sys/netinet/in.c

	# ./build.sh kernel=KERNCONF

	# mv /netbsd /netbsd.old

	# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd

	# shutdown -r now


For more information on how to do this, see:


   http://www.NetBSD.org/guide/en/chap-kernel.html


Thanks To

=========


Sean Boudreau for PoC code and implementing the fixes.


Revision History

================


	2006-04-12	Initial release


More Information

================


Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-012.tx...


Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.


Copyright 2006, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.


$NetBSD: NetBSD-SA2006-012.txt,v 1.6 2006/04/12 22:09:50 adrianp Exp $


-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.3 (NetBSD)


iQCVAwUBRD1+nD5Ru2/4N2IFAQJVdAQAqWpST2Mo4lvYBYAz7LNEpiknkUKjYeGg

M8Hp0OQXGLOf0A1fo/Tg4XuGgX7M38meelUpGpvfbMWqPg9AFZFV7JcKylQMnWFH

yRMNOJV1GV+25ZzT2pqxpPaGy+jleAW0Q6ZTNa4OsyCQztN8NS6AWMahTY5qmI/i

wojlqGVX1N8=

=B5UH

-----END PGP SIGNATURE-----
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
NetBSD Security Advisory 2007-005: IPv6 Type 0 Routing Header, NetBSD Security-Officer, (Thu Sep 13, 5:56 pm)
NetBSD developer's summit @ NYCBSDCon 2008, Jan Schaumann, (Sat Jul 12, 3:40 pm)
NetBSD Security Advisory 2008-001: file(1) Integer overflow, NetBSD Security-Officer, (Thu Feb 28, 7:36 pm)
New "regional" mailing lists, Luke Mewburn, (Tue May 20, 11:07 pm)
Summer of Code projects selected, Jan Schaumann, (Mon Apr 20, 10:44 pm)
Regional-pt mailing list is now available, Christos Zoulas, (Sun Jan 25, 3:02 pm)
The NetBSD project celebrates its fifteenth anniversary, Alistair Crooks, (Thu Mar 20, 2:57 am)
New NetBSD Developer, Simas Mockevicius, (Wed Nov 3, 1:00 pm)
NetBSD Security Advisory 2004-010: Insufficient argument val..., NetBSD Security-Officer, (Fri Dec 17, 1:29 am)
NetBSD Security Advisory 2008-011: ICMPv6 MLD query, NetBSD Security-Officer, (Thu Sep 4, 5:52 pm)
cvsweb maintenance, SODA Noriyuki, (Mon May 2, 7:25 am)
Announcing NetBSD and the Google "Summer of Code" Projects, Hubert Feyrer, (Sat Jun 25, 9:44 pm)
Brief outage of ftp.netbsd.org TODAY, 2009-07-14 02:45 UTC, Thor Simon, (Mon Jul 13, 8:35 pm)
Thank you for your donations!, Christos Zoulas, (Tue Jul 19, 9:05 am)
Summary of Changes to the Packages Collection in September 2..., Alistair Crooks, (Sat Oct 22, 8:41 am)
NetBSD 5.0_RC1 binaries available for download, Soren Jacobsen, (Thu Jan 29, 4:38 pm)
Manuel Bouyer interviewed on NetBSD/xen integration, Emmanuel Dreyfus, (Sun Feb 19, 4:24 am)
NetBSD Security Advisory 2006-004: Denial of services issues..., NetBSD Security-Officer, (Wed Mar 29, 9:30 pm)
NetBSD Security Advisory 2006-012: SIOCGIFALIAS ioctl may ca..., NetBSD Security-Officer, (Wed Apr 12, 10:34 pm)
NetBSD/vax is now ELF; New snapshot available, Matt Thomas, (Sun Mar 31, 10:56 pm)
NetBSD Security Advisory 2002-006: buffer overrun in libc DN..., NetBSD Security Officer, (Thu Jun 27, 1:14 pm)
NetBSD Security Advisory 2006-017: Sendmail malformed multip..., NetBSD Security-Officer, (Wed Jun 14, 5:44 pm)
NetBSD Security Advisory 2006-019: Malicious PPP options can..., NetBSD Security-Officer, (Wed Aug 23, 5:32 pm)
Mailinglist Archives not updated, Jan Schaumann, (Mon Jan 6, 2:57 pm)