dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


NetBSD Security Advisory 1999-012: ptrace

Feb 17, 2000, 20:37 (0 Talkback[s])
(Other stories by Daniel Carosone)

Date: Wed, 16 Feb 2000 07:58:57 +1100
From: Daniel Carosone security-officer@NETBSD.ORG
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: NetBSD Security Advisory 1999-012

NetBSD Security Advisory 1999-012


Topic: ptrace(2)'d processes can gain "kernel" privileges on vax.
Version: NetBSD/vax 1.4.1 and earlier; -current prior to 19991212
Severity: Theoretical problem only, no known exploits

Abstract


As part of an ongoing effort to construct a secure kernel and application environment, the NetBSD project has identified and corrected a possible security issue.

A wrapper program can be constructed by a local user that can modify the hardware privileges of a ptrace(2)'d process.

It might be possible to write a security-related exploit via this mechanism.

Technical Details


NetBSD uses the ptrace(2) system call to trace and debug other processes. The debugging process can also modify the internal registers, including the status (PSL) register, for the process being debugged.

Besides the normal user-accessible flags, the VAX hardware also stores information about privilege levels and used stacks in the PSL. Those flags are only altered via the instruction REI (return from interrupt) or LDPCTX (load process context) and cannot be modified while running in "user" mode.

When the PSL contents are altered by the debugging process, the debugged process is in the kernel, and will get the privileges defined by the PSL when it REI to userspace to continue execution.

Solutions and Workarounds


Upgrade to NetBSD-current, or apply the following patch to 1.4.1:
Index: machdep.c

RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v
retrieving revision 1.76.2.1
diff -c -r1.76.2.1 machdep.c
*** machdep.c   1999/04/16 16:26:01     1.76.2.1
- --- machdep.c   1999/12/12 11:08:46
***************
*** 770,776 ****
        tf->fp = regs->fp;
        tf->sp = regs->sp;
        tf->pc = regs->pc;
!       tf->psl = regs->psl;
        return 0;
  }

- --- 770,777 ----
        tf->fp = regs->fp;
        tf->sp = regs->sp;
        tf->pc = regs->pc;
!       tf->psl = (regs->psl|PSL_U|PSL_PREVU) &
!           ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */
        return 0;
  }

Thanks To


Discovery of the problem by Klaus Klein (kleink@netbsd.org)

Revision History


1999/12/12 - initial version

More Information


Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

Copyright 1999, The NetBSD Foundation, Inc. All Rights Reserved.