CVE-2016-1885

Related Files

FreeBSD Security Advisory - FreeBSD-SA-16:15.sysarch

Posted Oct 25, 2016

Authored by ahaha | Site security.freebsd.org

FreeBSD Security Advisory - A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

tags | advisory, denial of service, kernel, local

systems | freebsd

advisories | CVE-2016-1885

MD5 | 2928e81b104e6f66784c2fc8aa82ca7e

Download | Favorite | Comments (0)

FreeBSD Kernel amd64_set_ldt Heap Overflow

Posted Mar 17, 2016

Authored by Core Security Technologies, Francisco Falcon

Core Security Technologies Advisory - An integer signedness error has been found in the amd64_set_ldt() function in the FreeBSD kernel code (define d in the /sys/amd64/amd64/sys_machdep.c file), which implements the i386_set_ldt system call on the amd64 version of the OS. This integer signedness issue ultimately leads to a heap overflow in the kernel, allowing local unprivileged attackers to crash the system. FreeBSD 10.2 amd64 is affected.

tags | exploit, overflow, kernel

systems | freebsd, bsd

advisories | CVE-2016-1885

MD5 | 5fddced07d5ad899ebb2d9c6bf48f392

Download | Favorite | Comments (0)

FreeBSD Security Advisory - FreeBSD-SA-16:15.sysarch

Posted Mar 17, 2016

Authored by Core Security Technologies | Site security.freebsd.org

FreeBSD Security Advisory - A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to invalid use of a signed intermediate value in the bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

tags | advisory, denial of service, kernel, local

systems | freebsd

advisories | CVE-2016-1885

MD5 | 708f3ca1de7547e635db4e1854a95614

Download | Favorite | Comments (0)