-----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 1999-012
                 =================================

Topic:          ptrace(2)'d processes can gain "kernel" privileges on vax.
Version:        NetBSD/vax 1.4.1 and earlier; -current prior to 19991212
Severity:       Theoretical problem only, no known exploits


Abstract
========

As part of an ongoing effort to construct a secure kernel and application
environment, the NetBSD project has identified and corrected a possible
security issue.

A wrapper program can be constructed by a local user that can modify the
hardware privileges of a ptrace(2)'d process.

It might be possible to write a security-related exploit via this mechanism.


Technical Details
=================

NetBSD uses the ptrace(2) system call to trace and debug other processes.
The debugging process can also modify the internal registers, including
the status (PSL) register, for the process being debugged.

Besides the normal user-accessible flags, the VAX hardware also stores
information about privilege levels and used stacks in the PSL. Those
flags are only altered via the instruction REI (return from interrupt)
or LDPCTX (load process context) and cannot be modified while running
in "user" mode.

When the PSL contents are altered by the debugging process, the debugged
process is in the kernel, and will get the privileges defined by the
PSL when it REI to userspace to continue execution.

Solutions and Workarounds
=========================

Upgrade to NetBSD-current, or apply the following patch to 1.4.1:

Index: machdep.c
===================================================================
RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v
retrieving revision 1.76.2.1
diff -c -r1.76.2.1 machdep.c
*** machdep.c   1999/04/16 16:26:01     1.76.2.1
- --- machdep.c   1999/12/12 11:08:46
***************
*** 770,776 ****
        tf->fp = regs->fp;
        tf->sp = regs->sp;
        tf->pc = regs->pc;
!       tf->psl = regs->psl;
        return 0;
  }

- --- 770,777 ----
        tf->fp = regs->fp;
        tf->sp = regs->sp;
        tf->pc = regs->pc;
!       tf->psl = (regs->psl|PSL_U|PSL_PREVU) &
!           ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */
        return 0;
  }



Thanks To
=========

Discovery of the problem by Klaus Klein (kleink@netbsd.org)


Revision History
================

        1999/12/12 - initial version


More Information
================

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 1999, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA1999-012.txt,v 1.3 2000/02/15 13:33:47 dan Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBOKlXcD5Ru2/4N2IFAQEvPAP+IXJ+48+eC/iDXTDXTG4QLNsqBZT4QRki
Y6DI7j0NqioiEvuJScW54dVpL0rUOd7XJH5bI27q2XEBy2J9furOwjFDb3Y4gpoU
4GWyQyw1oCd3tGecfUETlFtBdPNM6qVObEeKeQr87kbUsugSZUW+RuY4OA6Lywf7
rTMlmyoYuss=
=xqwx
-----END PGP SIGNATURE-----