Results 1 to 2 of 2

Thread: FreeBSD-SA-02:09: fstatfs race condition may allow local DoS via procfs

  1. #1

    Exclamation FreeBSD-SA-02:09: fstatfs race condition may allow local DoS via procfs

    A race condition existed where a file could be removed between calling
    fstatfs() and the point where the file is accessed causing the file
    descriptor to become invalid. This may allow unprivileged local users
    to cause a kernel panic. Currently only the procfs filesystem is
    known to be vulnerable.


    I. Background

    fstatfs() is a function that retrieves filesystem statistics in the
    kernel. procfs is the process filesystem, which presents a filesystem
    interface to the system process table and associated data.

    II. Problem Description

    A race condition existed where a file could be removed between calling
    fstatfs() and the point where the file is accessed causing the file
    descriptor to become invalid. This may allow unprivileged local users
    to cause a kernel panic. Currently only the procfs filesystem is
    known to be vulnerable.

    III. Impact

    On vulnerable FreeBSD systems where procfs is mounted, unprivileged
    local users may be able to cause a kernel panic.

    IV. Workaround

    Unmount all instances of the procfs filesystem using the umount(8)
    command by performing the following as root:

    # umount -f -a -t procfs

    Disable the automatic mounting of all instances of procfs in
    /etc/fstab, remove or comment out the line(s) of the following form:

    proc /proc procfs rw 0 0

    Note that unmounting procfs may have a negative impact on the
    operation of the system: under older versions of FreeBSD it is
    required for some aspects of the ps(1) command, and unmounting it may
    also break use of userland inter-process debuggers such as gdb. Other
    installed binaries including emulated Linux binaries may require access
    to procfs for correct operation.

    V. Solution

    1) Upgrade your vulnerable FreeBSD system to 4.5-RELEASE or
    4.5-STABLE, or the RELENG_4_5, RELENG_4_4, or RELENG_4_3 security
    branches dated after their respective correction dates.

    2) FreeBSD 4.x systems prior to the correction date:

    The following patch has been verified to apply to all FreeBSD 4.x
    releases dated prior to the correction date. This patch may or may
    not apply to older, unsupported releases of FreeBSD.

    Download the patch and the detached PGP signature from the following
    locations, and verify the signature using your PGP utility.

    # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE.../fstatfs.patch
    # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...atfs.patch.asc

    Execute the following commands as root:

    # cd /usr/src
    # patch -p
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (FreeBSD)
    Comment: For info see http://www.gnupg.org

    ---[-eOf-]
    original article: http://www.xatrix.org/modules.php?op...1&mode=&order=
    What is essential is invisible
    to the eye ...
    ]ØÐÖ§|-|Å

  2. #2
    Senior Member
    Join Date
    Dec 2001
    Posts
    1,193
    Informative post. wonder if this race condition shows up in other ux with similar results.
    Trappedagainbyperfectlogic.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •