FreeBSD Security Advisory FreeBSD-SA-04:15.syscons

05/10/04, FreeBSD Security Advisory FreeBSD-SA-04:15.syscons
From: FreeBSD Security Advisories <>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

To: FreeBSD Security Advisories <>
Subject: FreeBSD Security Advisory FreeBSD-SA-04:15.syscons
From: FreeBSD Security Advisories <>
Date: Mon, 4 Oct 2004 20:54:12 GMT
List-archive: <>
List-help: <>
List-id: Moderated Security Notifications [moderated, low volume]<>
List-post: <>
List-subscribe: <>,<>
List-unsubscribe: <>,<>

Hash: SHA1

FreeBSD-SA-04:15.syscons                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Boundary checking errors in syscons

Category:       core
Module:         sys_dev_syscons
Announced:      2004-10-04
Credits:        Christer Oberg
Affects:        FreeBSD 5.x releases
Corrected:      2004-09-30 17:49:15 UTC (RELENG_5, 5.3-BETA6)
                2004-10-04 17:04:25 UTC (RELENG_5_2, 5.2.1-RELEASE-p11)
CVE Name:       CAN-2004-0919
FreeBSD only:   YES

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit

I.   Background

syscons(4) is the default console driver for FreeBSD.  Using the
physical keyboard and screen, it provides multiple virtual terminals
which appear as if they were separate terminals.  One virtual terminal
is considered current and exclusively occupies the screen and the
keyboard; the other virtual terminals are placed in the background.

II.  Problem Description

The syscons CONS_SCRSHOT ioctl(2) does insufficient validation of
its input arguments.  In particular, negative coordinates or large
coordinates may cause unexpected behavior.

III. Impact

It may be possible to cause the CONS_SCRSHOT ioctl to return portions of
kernel memory.  Such memory might contain sensitive information, such as
portions of the file cache or terminal buffers.  This information might
be directly useful, or it might be leveraged to obtain elevated
privileges in some way.  For example, a terminal buffer might include a
user-entered password.

IV.  Workaround

There is no known workaround.  However, this bug is only exploitable
by users who have access to the physical console or can otherwise open
a /dev/ttyv* device node.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to the RELENG_5_2 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.2

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch
# fetch

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:> and reboot the

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch                                                           Revision
- -------------------------------------------------------------------------
  src/sys/dev/syscons/syscons.c                                 1.409.2.1
- -------------------------------------------------------------------------

VII. References

Version: GnuPG v1.2.6 (FreeBSD)

_______________________________________________ mailing list
To unsubscribe, send any mail to ""

Previous message sorted by date: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-04:14.cvs
Next message sorted by date: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-04:16.fetch
Previous message sorted by thread: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-04:14.cvs
Next message by thread: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-04:16.fetch
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: Nov 2004