-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory:               Oracle Solaris UCODE_GET_VERSION IOCTL Kernel NULL 
                        Pointer Dereference 
Advisory ID:            TKADV2010-001
Revision:               1.0       
Release Date:           2010/01/31
Last Modified:          2010/01/31
Date Reported:          2009/11/29
Author:                 Tobias Klein (tk at trapkit.de)
Affected Software:      Solaris 10 with 127128-11 and w/o 143913-01 (x86)
                        OpenSolaris build snv_69 through snv_133 (x86)
Remotely Exploitable:   No
Locally Exploitable:    Yes 
Vendor URL:             http://www.oracle.com, http://www.sun.com/ 
Vendor Status:          Vendor has released an updated version
Patch development time: 61 days
CVE-ID:                 CVE-2010-0453


======================
Vulnerability Details: 
======================

The kernel of Oracle Solaris contains a vulnerability in the code that 
handles UCODE_GET_VERSION IOCTL requests. 

The vulnerability allows a local unprivileged user the ability to panic a 
Solaris x86 Intel-based system (32-bit/64-bit mode) due to a NULL pointer 
dereference. The ability to panic a system is a type of Denial of Service 
(DoS).

The issue can be triggered by sending a specially crafted IOCTL request to 
the kernel.


==================
Technical Details:
==================

The following source code references are based on the kernel source code 
available from http://www.opensolaris.org.

intel/io/ucode_drv.c:

[..]
static int
ucode_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *cr, int 
            *rval)
{
..
   switch (cmd) {
   case UCODE_GET_VERSION: {
     int size;
     uint32_t *revp, *rev_array;
     ucode_errno_t rc = EM_OK;

     STRUCT_DECL(ucode_get_rev_struct, h);
     STRUCT_INIT(h, mode);
 [1] if (ddi_copyin((void *)arg,
         STRUCT_BUF(h), STRUCT_SIZE(h), mode))
       return (EFAULT);

 [2] if ((size = STRUCT_FGET(h, ugv_size)) > NCPU)
       return (EINVAL);

     if ((rev_array = STRUCT_FGETP(h, ugv_rev)) == NULL)
       return (EINVAL);

     size *= sizeof (uint32_t);

 [3] revp = kmem_zalloc(size, KM_SLEEP);
     if (ddi_copyin((void *)rev_array, revp, size, mode) != 0) {
       kmem_free(revp, size);
       return (EINVAL);
     }

 [4] rc = ucode_get_rev(revp);
[..]

[1] The struct 'h' is filled with user controlled IOCTL input data.
[2] The value of 'size' derives from user controlled data.
[3] If 'size' has a value of 0, kmem_zalloc() will return NULL. This 
    results in revp pointing to NULL. 
[4] 'revp' is used as a function parameter for ucode_get_rev().


i86pc/os/microcode.c:

[..]
/*
 * Returns microcode revision from the machcpu structure.
 */
ucode_errno_t
ucode_get_rev(uint32_t *revp)
{
   int i;

   ASSERT(ucode);
   ASSERT(revp);

   if (!ucode->capable(CPU))
     return (EM_NOTSUP);

   mutex_enter(&cpu_lock);
   for (i = 0; i < max_ncpus; i++) {
     cpu_t *cpu;

     if ((cpu = cpu_get(i)) == NULL)
       continue;

 [5] revp[i] = cpu->cpu_m.mcpu_ucode_info->cui_rev;
[..]

[5] This assignment leads to a NULL pointer dereference as 'revp == NULL'.


========= 
Solution: 
=========

This issue is addressed in the following patch releases from Oracle/Sun:
    
x86 Platform
    - Solaris 10 with patch 143913-01 or later
    - OpenSolaris based upon builds snv_134 or later


====================
Disclosure Timeline: 
====================

  2009/11/29 - Initial vendor notification
  2009/11/30 - Oracle/Sun confirms the vulnerability
  2010/01/08 - Status update by Oracle/Sun
  2010/01/25 - Status update by Oracle/Sun
  2010/01/29 - Patch 143913-01 released for Solaris 10
  2010/01/31 - Release date of this security advisory


======== 
Credits: 
========

  Vulnerability found and advisory written by Tobias Klein.


=========== 
References: 
===========

[REF1] http://sunsolve.sun.com/search/document.do?assetkey=1-21-143913-01-1
[REF2] http://www.trapkit.de/advisories/TKADV2010-001.txt


======== 
Changes: 
========

  Revision 0.1 - Initial draft release to the vendor
  Revision 1.0 - Public release


===========
Disclaimer:
===========

The information within this advisory may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are no warranties, implied or express, with regard
to this information. In no event shall the author be liable for any
direct or indirect damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this
information is at the user's own risk.


================== 
PGP Signature Key: 
==================

  http://www.trapkit.de/advisories/tk-advisories-signature-key.asc

  
Copyright 2010 Tobias Klein. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: PGP
Charset: utf-8

wj8DBQFLZVx1kXxgcAIbhEERAk3LAJ44NNQKGUbHu1AIHcZWpysW0cQ7HQCg9DcX
7rqrkip5hSx+zx3PfcqzOOk=
=CWdo
-----END PGP SIGNATURE-----