-----BEGIN PGP SIGNED MESSAGE-----


     NetBSD Security Advisory 2001-015
     =================================

Topic:    Insufficient checking of lengths passed from userland to kernel

Version:  NetBSD-current:  source prior to August 5, 2001
    NetBSD-1.5.1:  affected
    NetBSD-1.5:  affected
    NetBSD-1.4.*:  affected

Severity:  Any local user can panic the system, and/or execute
    arbitrary code and gain root privileges.

Fixed:    NetBSD-current:    August 5, 2001
    NetBSD-1.5 branch:  August 16, 2001 (1.5.2 includes the fix)


Abstract
========

The problem for which NetBSD SA2001-011 was issued (``Insufficient
msg_controllen checking for sendmsg(2)'') urged an audit of
NetBSD code to look for similar issues in other parts of kernel.

A number of issues were found. In a number of places lengths or
sizes passed from userland were used by the kernel without sufficient
checks.

Most of the problems involved errors handling signed versus unsigned
values, in some cases the code was not checking for negative values.

The actual severity of these problems varies, and three different
problem severity groups have been identified:

1.  semop(2) - exploitable by any user for denial of service or
  to execute arbitrary kernel code

2.  mount args - exploitable by any user for denial of service if
  user mounts are enabled (it's disabled by default on NetBSD 1.5
  and later)

3.  some device ioctls - exploitable by any user with write access
  to appropriate device files (by default only root has write access
  on most device files)

Technical Details
=================

The kernel function sys_semop() (which is the entry point for the
semop(2) syscall) stores an unsigned argument 'nsops' in a local signed
variable.  If a user passes a sufficiently big 'nsops' value (>INT_MAX),
the local signed variable ends up negative and passes the bound check.
The value is then used for copyin() data from user memory to local array
on the process's kernel stack. Since the number of bytes to copyin is
computed as 'nsops * sizeof(struct sembuf)', this can be used to copy an
almost arbitrary number of bytes from userland to the caller process's
kernel stack due to int overflow. This can be exploited to cause a
kernel trap, or call arbitrary kernel code. This can also be exploited
to execute arbitrary code on architectures where stack memory is
executable.

NFS did not check the nfs file handle size. This could be exploited in
a way similar to the semop(2) issue.  Furthermore, NFS did not check the
size of authenticator and verifier strings sufficiently.  UMAPFS did not
check the nentries and gnentries mount arguments.
Generic code in kern/nfs_subr.c:vfs_hand_addrlist() did not properly
bound check the specified size of export addresses; this code is
used by all filesystems to handle exports.  All these problems
could be exploited to cause a panic.

The following drivers had potentially exploitable weak checking in their
ioctl(9) routines. These should be exploitable to cause a kernel
panic. Some of these drivers are new on -current and don't exist
in NetBSD/1.5.

amiga:    majority of graphic grf-like device drivers
arm32:    vidcvideo
hpcmips:  plumvideo
macppc:    ofb
sparc:    cgtwo, fb
sun3:    cg2, fb
hpcsh:    hd64461video
machine-independant:  coda, bt, mlx, pci/tga, tc/cfb, tc/mfb,
    tc/sfb, tc/tfb, tc/xcfb, tc/sfbplus, tc/stic,
    wsdisplay, wskbd, ccd, ppp, isdn

The lfs_markv(2) system call did not check the blkcnt argument. This
problem is exploitable to cause a panic.  This system call is restricted
to root only.

Solutions and Workarounds
=========================

NetBSD official releases up to and including 1.5.1 are vulnerable.
NetBSD 1.5.2 is NOT vulnerable.

Kernel sources must be updated and a new kernel built and installed.
Once the kernel sources have been updated, rebuild the kernel,
install it, and reboot.  For more information on how to do this,
see:
  http://www.netbsd.org/Documentation/kernel/#how_to_build_a_kernel

The instructions for updating your kernel sources depend upon which
particular NetBSD release you are running.


* NetBSD-current:

  Systems running NetBSD-current dated from before 2001-08-05
  should be upgraded to NetBSD-current dated 2001-08-06 or later.

  The following source directories need to be updated from
  the netbsd-current CVS branch (aka HEAD):
    src/sys/kern
    src/sys/miscfs/umapfs
    src/sys/ufs/lfs
    src/sys/nfs
    src/sys/dev
    src/sys/arch


  Alternatively, apply the following patch (with potential offset
  differences):
    ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-015-kernlen-current.patch

  To patch:
    # cd src/sys
    # patch < /path/to/SA2001-015-kernlen-current.patch


* NetBSD 1.5, 1.5.1:

  Systems running NetBSD 1.5 dated from before 2001-08-16 should be
  upgraded from NetBSD 1.5 sources dated 2001-08-17 or later.

  The following source directory needs to be updated from the
  netbsd-1-5 CVS branch:
    src/sys/kern
    src/sys/miscfs/umapfs
    src/sys/nfs
    src/sys/dev
    src/sys/arch


  Alternatively, apply the following patch (with potential offset
  differences):
    ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-015-kernlen-1.5.patch

  To patch:
    # cd src/sys
    # patch < /path/to/SA2001-015-kernlen-1.5.patch


* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

  At this time there are no fixes or patches available for
  the NetBSD 1.4 branch.


Thanks To
=========

Jaromir Dolecek for copyin/malloc audit work.

Konrad Schroder for review of LFS fix.

Ken Ashcraft @ Stanford, Constantine Sapuntzakis and
Frank van den Linden for finding and fixing
the NFS file handle length problem.

Andrew Doran for review of the mlx fix.

Steve Woodford for review of sun3/vme and xd/xy driver changes,
which turned out to not be necessary.

Christos Zoulas for general feedback.


Revision History
================

  2001-09-06  Initial release


More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-015.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2001, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2001-015.txt,v 1.9 2001/09/06 13:52:31 lukem Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBO5d/Gj5Ru2/4N2IFAQF9YAP/ckqmwEHQcuqaOiJ/XJw7zREJ6luIgp5j
CLz0ahgcpFgbDe6QGUQBdouK4FlD6/uTAc4euJ9Dyiq0tVRty2U5yAbJPjOznv8r
T72DjjK+HN4UDvnz+DRniC7upWzDjfEgdi/tb74sWKF/RA9e+3mk0Ecd4UzpmMrl
CxH4j9XcqTI=
=exNB
-----END PGP SIGNATURE-----