News
Vigil@nce - FreeBSD: privilege escalation via Linux SIOCGIFCONF
December 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can create a binary program for Linux using the
SIOCGIFCONF ioctl, and by running it on FreeBSD, can elevate his
privileges.
Impacted products: FreeBSD
Severity: 2/4
Creation date: 23/11/2012
DESCRIPTION OF THE VULNERABILITY
FreeBSD contains a kernel module to execute Linux binary programs.
The SIOCGIFCONF ioctl is used to retrieve the IP addresses of a
network interface. In order to do so, the user program provides an
argument of type "struct ifconf", containing a pointer (ifc_buf)
to the buffer that the kernel should fill.
The function linux_ifconf() in sys/compat/linux/linux_ioctl.c
implements this ioctl. However, the kernel does not check whether
the destination buffer is in the data user space, so an attacker
can make the kernel write to a memory address with its own
privileges.
An attacker can create a binary program for Linux using the
SIOCGIFCONF ioctl, and by running it on FreeBSD, can elevate his
privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/FreeBSD-privilege-escalation-via-Linux-SIOCGIFCONF-12181
