what you don't know can hurt you

FreeBSD Security Advisory - ioctl(2) Insufficient Credential Checks

FreeBSD Security Advisory - ioctl(2) Insufficient Credential Checks
Posted Sep 10, 2013
Authored by Loganaden Velvindron, Gleb Smirnoff | Site security.freebsd.org

FreeBSD Security Advisory - The ioctl(2) system call allows an application to perform device- or protocol-specific operations through a file or socket descriptor associated with a specific device or protocol. As is commonly the case, the IPv6 and ATM network layer ioctl request handlers are written in such a way that an unrecognized request is passed on unmodified to the link layer, which will either handle it or return an error code. Network interface drivers, however, assume that the SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been handled at the network layer, and therefore do not perform input validation or verify the caller's credentials. Typical link-layer actions for these requests may include marking the interface as "up" and resetting the underlying hardware. An unprivileged user with the ability to run arbitrary code can cause any network interface in the system to perform the link layer actions associated with a SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl request; or trigger a kernel panic by passing a specially crafted address structure which causes a network interface driver to dereference an invalid pointer. Although this has not been confirmed, the possibility that an attacker may be able to execute arbitrary code in kernel context can not be ruled out.

tags | advisory, arbitrary, kernel, protocol
systems | freebsd
advisories | CVE-2013-5691
MD5 | 63e2ef236f0fd330d48b4724959355f7

FreeBSD Security Advisory - ioctl(2) Insufficient Credential Checks

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-13:12.ifioctl Security Advisory
The FreeBSD Project

Topic: Insufficient credential checks in network ioctl(2)

Category: core
Module: sys_netinet6 sys_netatm
Announced: 2013-09-10
Credits: Loganaden Velvindron
Gleb Smirnoff
Affects: All supported versions of FreeBSD.
Corrected: 2013-09-10 10:07:21 UTC (stable/9, 9.2-STABLE)
2013-09-10 10:08:20 UTC (releng/9.2, 9.2-RC1-p2)
2013-09-10 10:08:20 UTC (releng/9.2, 9.2-RC2-p2)
2013-09-10 10:08:20 UTC (releng/9.2, 9.2-RC3-p1)
2013-09-10 10:15:33 UTC (releng/9.1, 9.1-RELEASE-p7)
2013-09-10 10:12:09 UTC (stable/8, 8.4-STABLE)
2013-09-10 10:14:19 UTC (releng/8.4, 8.4-RELEASE-p4)
2013-09-10 10:13:14 UTC (releng/8.3, 8.3-RELEASE-p11)
CVE Name: CVE-2013-5691

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

I. Background

The ioctl(2) system call allows an application to perform device- or
protocol-specific operations through a file or socket descriptor
associated with a specific device or protocol.

The SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK
ioctl requests are used to associate a network address, broadcast
address, destination address (for point-to-point interfaces) or
netmask with an interface. They operate on the assumption that each
interface only has one address per protocol, and are therefore of
limited use for IPv4, where interfaces may have more than one address.
They were never implemented for IPv6, where interfaces nearly always
have at least two, and in many cases three, addresses; nor were they
ever implemented for ATM.

II. Problem Description

As is commonly the case, the IPv6 and ATM network layer ioctl request
handlers are written in such a way that an unrecognized request is
passed on unmodified to the link layer, which will either handle it or
return an error code.

Network interface drivers, however, assume that the SIOCSIFADDR,
SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been
handled at the network layer, and therefore do not perform input
validation or verify the caller's credentials. Typical link-layer
actions for these requests may include marking the interface as "up"
and resetting the underlying hardware.

III. Impact

An unprivileged user with the ability to run arbitrary code can cause
any network interface in the system to perform the link layer actions
associated with a SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR or
SIOCSIFNETMASK ioctl request; or trigger a kernel panic by passing a
specially crafted address structure which causes a network interface
driver to dereference an invalid pointer.

Although this has not been confirmed, the possibility that an attacker
may be able to execute arbitrary code in kernel context can not be
ruled out.

IV. Workaround

No workaround is available.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-13:12/ifioctl.patch
# fetch http://security.FreeBSD.org/patches/SA-13:12/ifioctl.patch.asc
# gpg --verify ifioctl.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

3) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

VI. Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path Revision
- -------------------------------------------------------------------------
stable/8/ r255445
releng/8.3/ r255446
releng/8.4/ r255447
stable/9/ r255443
releng/9.1/ r255448
releng/9.2/ r255444
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:

<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

VII. References

<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5691>

The latest revision of this advisory is available at
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-13:12.ifioctl.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (FreeBSD)

iEYEARECAAYFAlIu8rUACgkQFdaIBMps37ImRQCdGUcSBvK6+kAN69aGChHT6fVb
YI4AoJNveN9PSowTG0NnUkPJR9oJimZT
=xb3g
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close