8lgm-18.txt
e5ec4dd1ff9bd572ed17dd48e41959530789293aa37e1e228538ecba537cd560
This advisory has been sent to:
comp.security.unix
===========================================================================
[8lgm]-Advisory-18.UNIX.SunOS-kernel.4-Dec-1994
PROGRAM:
SunOS 4.1.x kernel
VULNERABLE OS's:
SunOS 4.1.x
DESCRIPTION:
A problem was reported to bugtraq showing that unprivileged users
can panic the SunOS 4.1.x kernel if an HSFS cdrom is mounted.
The purpose of this advisory is to provide a workaround for
this problem. This patch has been successfully tested by a number
of people.
IMPACT:
Any user can crash the system.
REPEAT BY:
Assuming /cdrom is an hsfs filesystem, execute the following
program:
main()
{
pathconf("/cdrom", 0);
}
Obviously do not do this, unless you have the authority to
install the fix below.
DISCUSSION:
Two vnodeops in the hsfs_vnodeops struct appear to be left
undefined. This fix points them to a real function which
then fails the operation in the correct way.
WORKAROUND & FIX:
1. Contact your vendor for a patch.
2. In the meantime either install the workaround given
below, or avoid using HSFS mounted filesystems.
8<------------------------- cut here -------------------------
/*
* 8lgm_hsfs.c - SunOS 4.1.x HSFS bugfix.
* Copyright (C) 1994 by [8LGM].
*
* To use:
* cc -c -O -DKERNEL -D<kernel-arch> 8lgm_hsfs.c
* modload 8lgm_hsfs.o
*/
#include <sys/types.h>
#include <sys/conf.h>
#include <sys/buf.h>
#include <sys/param.h>
#include <sys/errno.h>
#include <sys/user.h>
#include <sys/time.h>
#include <sys/vfs.h>
#include <sys/vnode.h>
#include <sys/ucred.h>
#include <sys/syslog.h>
#include <sundev/mbvar.h>
#include <sun/autoconf.h>
#include <sun/vddrv.h>
extern struct vnodeops hsfs_vnodeops;
struct vdldrv vd;
int (*old_hsfs_cntl)() = NULL;
int (*old_hsfs_realvp)() = NULL;
int loaded_8lgm_hsfs = 0;
int
hsfs_invalid()
{
return (EINVAL);
}
int
load_8lgm_hsfsfix()
{
int x;
x = splhigh();
old_hsfs_cntl = hsfs_vnodeops.vn_cntl;
old_hsfs_realvp = hsfs_vnodeops.vn_realvp;
hsfs_vnodeops.vn_cntl = hsfs_invalid;
hsfs_vnodeops.vn_realvp = hsfs_invalid;
splx(x);
return(0);
}
int
unload_8lgm_hsfsfix()
{
int x;
x = splhigh();
hsfs_vnodeops.vn_cntl = old_hsfs_cntl;
hsfs_vnodeops.vn_realvp = old_hsfs_realvp;
splx(x);
return(0);
}
int
xxxinit(function_code, vdp, vdi, vds)
unsigned int function_code;
struct vddrv *vdp;
addr_t vdi;
struct vdstat *vds;
{
bzero(&vd, sizeof(vd));
vd.Drv_magic = VDMAGIC_PSEUDO;
vd.Drv_name = "8lgm-hsfs";
switch(function_code) {
case VDLOAD:
if (loaded_8lgm_hsfs) {
log(LOG_INFO, "8lgm: hsfs fix module loaded\n")
;
return(EEXIST);
}
vdp->vdd_vdtab = (struct vdlinkage*)&vd;
load_8lgm_hsfsfix();
loaded_8lgm_hsfs++;
log(LOG_INFO, "8lgm: hsfs fix module loaded\n");
return(0);
case VDUNLOAD:
return (unload(vdp, vdi));
case VDSTAT:
return(0);
default:
return(EIO);
}
}
static int
unload(vdp, vdi)
struct vddrv *vdp;
struct vdioctl_unload *vdi;
{
if (loaded_8lgm_hsfs == 0) {
log(LOG_INFO, "8lgm: hsfs fix module not loaded!\n");
return(0);
}
unload_8lgm_hsfsfix();
loaded_8lgm_hsfs = 0;
log(LOG_INFO, "8lgm: hsfs fix module unloaded\n");
return(0);
}
8<------------------------- cut here -------------------------
-----------------------------------------------------------------------
FEEDBACK AND CONTACT INFORMATION:
majordomo@8lgm.org (Mailing list requests - try 'help'
for details)
8lgm@8lgm.org (Everything else)
8LGM FILESERVER:
All [8LGM] advisories may be obtained via the [8LGM] fileserver.
For details, 'echo help | mail 8lgm-fileserver@8lgm.org'
8LGM WWW SERVER:
[8LGM]'s web server can be reached at http://www.8lgm.org.
This contains details of all 8LGM advisories and other useful
information.
===========================================================================