AusCERT - ESB-2000.400 -- FreeBSD-SA-00:77.procfs -- Several vulnerabilities in procfs

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2000.400 -- FreeBSD-SA-00:77.procfs -- Several vulnerabilities in procfs
Date: 19 December 2000
References: ESB-2001.016

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                   ESB-2000.400 -- FreeBSD-SA-00:77.procfs
                      Several vulnerabilities in procfs
                              19 December 2000

===========================================================================

	AusCERT Security Bulletin Summary
	---------------------------------

Product:                procfs
Vendor:                 FreeBSD
Operating System:       FreeBSD
                        BSD
Impact:                 Root Compromise
Access Required:        Local

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-00:77                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          Several vulnerabilities in procfs

Category:       core
Module:         procfs
Announced:      2000-12-18
Affects:        Problem #1: FreeBSD 4.x prior to the correction date.
                            FreeBSD 3.x is unaffected.
                Problem #2, #3: FreeBSD 4.x and 3.x prior to the correction
                            date.
Corrected:      2000-12-16 (FreeBSD 4.2-STABLE)
                2000-12-18 (FreeBSD 3.5.1-STABLE)
Credits:        Frank van Vliet <karin@root66.org>
                Joost Pol <nohican@niets.org> (Problem #1, #2)
                Esa Etelavuori <eetelavu@cc.hut.fi> (Problem #3)
FreeBSD only:   NO

I.   Background

procfs is the process filesystem, which presents a filesystem
interface to the system process table, together with associated data.

II.  Problem Description

There were several problems discovered in the procfs code:

1) Unprivileged local users can gain superuser privileges due to
insufficient access control checks on the /proc/<pid>/mem and
/proc/<pid>/ctl files, which gives access to a process address space
and perform various control operations on the process respectively.

The attack proceeds as follows: the attacker can fork() a child
process and map the address space of the child in the parent.  The
child process then exec()s a utility which runs with root or other
increased privileges.  The parent process incorrectly retains read and
write access to the address space of the child process which is now
running with increased privileges, and can modify it to execute
arbitrary code with those privileges.

2) Unprivileged local users can execute a denial of service against
the local machine by mmap()ing a processes own /proc/<pid>/mem file in
the procfs filesystem.  This will cause the system to enter into an
infinite loop in the kernel, effectively causing the system to hang
until manually rebooted by an administrator on the system console.

3) Users with superuser privileges on the machine, including users
with root privilege in a jail(8) virtual machine, can overflow a
buffer in the kernel and bypass access control checks placed on the
abilities of the superuser.  These include the ability to "break out"
of the jail environment (jail is often used as a compartmentalization
tool for security purposes), to lower the system securelevel without
requiring a reboot, and to introduce new (possibly malicious) code
into the kernel on systems where loading of KLDs (kernel loadable
modules) has been disabled.

III. Impact

1) On vulnerable FreeBSD 4.x systems where procfs is mounted,
unprivileged local users can obtain root privileges.

2) On vulnerable FreeBSD 4.x and 3.x systems where procfs is mounted,
unprivileged local users can cause the system to hang.

3) On vulnerable FreeBSD 4.x and 3.x systems, superusers who can load
the procfs filesystem, or on systems where it is already mounted, can
bypass access control checks in the kernel which would otherwise limit
their abilities.  Consequences include the ability to break out of a
jail environment, to lower securelevel or to introduce malicious code
into the kernel on systems where loading of KLDs has been disabled.
For many systems this vulnerability is likely to have minor impact.

IV.  Workaround

To work around problems 1 and 2, perform the following steps as root:

Unmount all instances of the procfs filesystem using the umount(8)
command:

# umount -f -a -t procfs

Disable the automatic mounting of all instances of procfs in
/etc/fstab: remove or comment out the line(s) of the following form:

proc                    /proc           procfs  rw              0       0

The linprocfs filesystem, which provides additional interfaces to
Linux binaries to emulate the Linux procfs filesystem, is believed not
to be vulnerable to the problems described in this advisory and
therefore does not need to be unmounted. Note however that some Linux
binaries may require the presence of both procfs and linprocfs in
order to function correctly.

To work around problem 3 is more difficult since it involves the
superuser, but the following steps are believed to be sufficient:

* Unmount all procfs filesystems which are visible from within jail
  environments, to prevent a jail root compromise from compromising
  the entire system.  Since jailed users do not have the ability to
  mount filesystems, a successful jail root compromise in a jail
  without procfs visible cannot exploit this vulnerability.

* Remove the "options PROCFS" line from your kernel configuration file,
  if present, and compile a new kernel as described in
  http://www.freebsd.org/handbook/kernelconfig.html

  If the running kernel was compiled with "options PROCFS", then any user
  who has root privileges can mount procfs and exploit vulnerability 3,
  regardless of system securelevel.

  If the kernel does not include this option, then an attempt to mount
  procfs will trigger a load of the procfs.ko KLD module, which is
  denied at securelevel greater than zero.  Since this vulnerability
  only has meaning (in the case of unjailed root users) on systems which
  are kept in a securelevel greater than zero, this will always be
  true, and such systems are not vulnerable to the problem.

Note that unmounting procfs may have a negative impact on the
operation of the system: under older versions of FreeBSD it is
required for some aspects of the ps(1) command, and it may also break
use of userland inter-process debuggers such as gdb.  Other installed
binaries including emulated Linux binaries may require access to
procfs for correct operation.

V.   Solution

Upgrade your vulnerable FreeBSD system to 4.2-STABLE after the
correction date, or patch your present system source code and rebuild.

To patch your present system: download the relevant patch from the
below location, and execute the following commands as root:

[FreeBSD 3.5.1-RELEASE]

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.3.5.1.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.3.5.1.patch.asc

Verify the detached PGP signature using your PGP utility.

[FreeBSD 4.1-RELEASE and FreeBSD 4.1.1-RELEASE]

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.4.1.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.4.1.patch.asc

Verify the detached PGP signature using your PGP utility.

[FreeBSD 4.2-RELEASE]

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.4.2.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-00:77/procfs.4.2.patch.asc

Verify the detached PGP signature using your PGP utility.

# cd /usr/src/sys
# patch -p < /path/to/patch

If procfs is statically compiled into the kernel (e.g. the kernel
configuration file contains the line 'options PROCFS'), then rebuild
and reinstall your kernel as described in
http://www.freebsd.org/handbook/kernelconfig.html and reboot the
system with the new kernel for the changes to take effect.

If procfs is dynamically loaded by KLD (use the kldstat command to
verify whether this is the case) and the system securelevel has not
been raised, then the system can be patched at run-time without
requiring a reboot, by performing the following steps after patching
the source as described above:

# cd /usr/src/sys/modules/procfs
# make all install
# umount -f -a -t procfs
# kldunload procfs
# kldload procfs
# mount -f -a -t procfs
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBOj4uH1UuHi5z0oilAQG4GAP6ArdnOC6dolMGQt4p6yrd+ssEKD62Uh7a
y0EGd/7iFi7exxe+jWHQJVQmtyD4o8QYmO6qSJ+lb2iNYJTyKOlPWFWDlUlIhu3e
UvsArp9ns/4ERR7eYDvpK095np1ZB6qnLXChQf/oxj7W41QBzmK7Yc/+WW57pwLl
DS2/5AzXxXM=
=Yol+
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOlSNcih9+71yA2DNAQG8hgQAlH18xwXqBwsfbZ2hBJ3jLKeW36OGUrVa
aBBfUuvL3OInNLIX2YHgF2CZ4eybSgxQJCMSeP+d7iCSeqUrGkO9IJbRa+8SoPuM
E6Jsc3da7Z042vafvawO73JeehN7M4Oxcd/IhNpak5jqEYi52u3Xera3CWUdXXuU
roTKwCv+PWw=
=6L0e
-----END PGP SIGNATURE-----