From owner-freebsd-announce  Fri Sep  3 22:44:11 1999
Delivered-To: freebsd-announce@freebsd.org
Received: from rover.village.org (rover.village.org [204.144.255.49])
	by hub.freebsd.org (Postfix) with ESMTP
	id B45E014DEF; Fri,  3 Sep 1999 22:43:55 -0700 (PDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (harmony.village.org [10.0.0.6])
	by rover.village.org (8.9.3/8.9.3) with ESMTP id XAA24408;
	Fri, 3 Sep 1999 23:43:06 -0600 (MDT)
	(envelope-from imp@harmony.village.org)
Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id XAA63557; Fri, 3 Sep 1999 23:43:21 -0600 (MDT)
Message-Id: <199909040543.XAA63557@harmony.village.org>
From: security-officer@freebsd.org
To: freebsd-announce@freebsd.org
Cc: security-notifications@freebsd.org
Subject: FreeBSD-SA-99:02: Profiling Across Exec Calls
Date: Fri, 03 Sep 1999 23:43:21 -0600
Sender: owner-freebsd-announce@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

-----BEGIN POP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-99:02                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          Profiling Across Exec Calls

Category:       core
Module:         kernel
Announced:      1999-09-04
Affects:        FreeBSD 3.2 (and earlier)
		FreeBSD-current before the correction date.
Corrected:      FreeBSD-3.3 RELEASE
		FreeBSD-current as of August 11, 1999
		FreeBSD-3.2-stable as of August 22, 1999
FreeBSD only:   No

Patches:        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-99:02/

I.   Background

FreeBSD provides a mechanism to profile a running executable to aid in
performance tuning.  This can be accomplished via a kernel mechanism
to statistically sample the program counter of the program under
profile.

II.  Problem Description

A flaw exists in the implementation which allows an attacker to cause
arbitrary locations in program executed by the attacker.

III. Impact

No attacks against using this vulnerability this are known at this
time.  An attacker could theoretically gain root access from a
carefully crafted attack.

IV.  Workaround

Since profiling is done in the kernel via the profil(2) system call,
one must patch the kernel so no workaround is possible.

V.   Solution

Apply the following patch.  It will apply to both FreeBSD-current before
the resolution date and to 3.2-stable before the resolution date.

    Index: kern_exec.c
    ===================================================================
    RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/kern_exec.c,v
    retrieving revision 1.99
    retrieving revision 1.100
    diff -u -r1.99 -r1.100
    --- kern_exec.c	1999/04/27 11:15:55	1.99
    +++ kern_exec.c	1999/08/11 20:35:38	1.100
    @@ -228,6 +228,9 @@
     		fdfree(p);
     		p->p_fd = tmp;
     	}
    +
    +	/* Stop profiling */
    +	stopprofclock(p);
     
     	/* close files on exec */
     	fdcloseexec(p);


=============================================================================
FreeBSD, Inc.

Web Site:                       http://www.freebsd.org/
Confidential contacts:          security-officer@freebsd.org
Security notifications:         security-notifications@freebsd.org
Security public discussion:     freebsd-security@freebsd.org
PGP Key:                ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc

Notice: Any patches in this document may not apply cleanly due to
        modifications caused by digital signature or mailer software.
        Please reference the URL listed at the top of this document
        for original copies of all patches if necessary.
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBN9Cut1UuHi5z0oilAQE7IgP/Rg5oAQkmI/Wzcp5x3xWlomDAQQJFVlXp
7X9q6yux0Gx2fLU+1TcPS+dD6S7UOcDBgMMHXGqVNDnGJZSoRDIe7pNioZ/ZHVbT
uh51tJBHscumrvgU2HbHcgtxLmmzlwWByf2J6UKWMLlZXWy9ieZRVTug7Zl977OM
NXmKDU2au/Y=
=RCXc
-----END PGP SIGNATURE-----


This is the moderated mailing list freebsd-announce.
The list contains announcements of new FreeBSD capabilities,
important events and project milestones.
See also the FreeBSD Web pages at http://www.freebsd.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-announce" in the body of the message