NetBSD Security Advisory 2017-006: Vnode reference leak in the openat system call
8 September, 2017 by security-officer@netbsd.org | netbsd
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2017-006 ================================= Topic: Vnode reference leak in the openat system call Version: NetBSD-current: source prior to Sun, July 9th 2017 NetBSD 8.0 beta: affected NetBSD 7.1: affected NetBSD 7.0 - 7.0.2: affected NetBSD 6.1 - 6.1.4: not affected NetBSD 6.0 - 6.0.5: not affected Severity: Local privilege escalation Fixed: NetBSD-current: Sun, July 9th 2017 NetBSD-8 branch: Mon, July 10th 2017 NetBSD-7-1 branch: Mon, July 10th 2017 NetBSD-7-0 branch: Mon, July 10th 2017 NetBSD-7 branch: Mon, July 10th 2017 Teeny versions released later than the fix date will contain the fix. Please note that NetBSD releases prior to 6.0 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract ======== An easily exercisable error path in the kernel leaves behind an unreclaimed reference to a vnode. This prevents unmounting the affected volume, allowing local denial of service. It is likely that tickling the weakness repeatedly can be used to corrupt the kernel heap and thus gain kernel-level privileges, even with securelevel enabled. Technical Details ================= When calling the openat system call using a file descriptor that does not name a directory as the starting point for path lookup, a reference to the underlying vnode is taken temporarily and then not released when the error is discovered. Performing such a call often enough results in overflowing the internal reference count and corrupting the kernel heap. Solutions and Workarounds ========================= For all NetBSD versions, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel. In these instructions, replace: ARCH with your architecture (from uname -m), KERNCONF with the name of your kernel configuration file and VERSION with the file version below File versions containing the fixes: FILE HEAD netbsd-8 netbsd-7 netbsd-7-1 netbsd-7-0 ---- ---- -------- -------- ---------- ---------- sys/kern/vfs_lookup.c 1.208 1.207.2.1 1.201.4.1 1.201.12.1 1.201.8.1 To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P -r VERSION sys/kern/vfs_lookup.c # ./build.sh kernel=KERNCONF # mv /netbsd /netbsd.old # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd # shutdown -r now For more information on how to do this, see: http://www.NetBSD.org/guide/en/chap-kernel.html Thanks To ========= Mateusz Guzik for noticing the issue, and David A. Holland for deploying the fix. Revision History ================ 2017-09-08 Initial release More Information ================ Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2017-00N.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ . Copyright 2017, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJZsqisAAoJEAZJc6xMSnBuu4AP/0ytQhuSMf1hjvg5Gdg9TT5N 4anruzy9VY6P4PqkPVjJTv7YYlOCTtP7Svg4+CbwIjRoNNyKycUhEmBzUWpmLQL1 UaKE44lJExbD1qIL4aU5LweD+RnGQbdo9LwMC31rK8dUSKCpkc6K7yt+TnA2SMw/ a2IlJtqkX5lk+HAQ3TF32STPz+oijtEJBFjTCzWw4uLpAbvvdephuzQRR4H3d324 3iD0pcLRblpOAZ7qeOG6iCcpemMxu33T2IphsNL1Sx2JyKmqObtyRoNU8O6V7ldP L1VGIAU5cNW6+zCbvKLyTKLbze5eRuGx5x/fLbHnjlodGrdshxzIqEUVUGyD+hJJ JP1pYo3Mj/BJwnjLhv8hNWyuX6VtnEgl0B5C2U7X2K5c05DZnRvSrSHrIiGjIEoV p7LvbgLXtIEdzpOrx4kZ5DoHAVAjBm0gLrVwK1r8nSgOPmEzLpzaC3fCCL/x4cfZ JfMJvA3QbQJOpNdOexDcr1eD7VUFpZE7mE6kI8UUCpF71446A3cGpMkftSt/i6vn htDCqnmYJ10w2NtRc99VGIdgUZUM7d3as83HGKrHcTous0qKyutrB+WlEpGHIRY5 mq7gCoRqikbxBKhnYlADGJRXTk9FBw2ai08SIOsRW7SSlVNwtPq09xhT0X6NsKA0 IsQfy4QZa1g+ecssqDHg \kQ -----END PGP SIGNATURE-----