FreeBSD Security Advisory FreeBSD-SA-19:02.fd

06/02/19, FreeBSD Security Advisory FreeBSD-SA-19:02.fd
From: FreeBSD Security Advisories <security-advisories@freebsd.org>

Generated by MHonArc

CSIM Logo WelcomeCourses
Faculty, Student, Staff
Projects and reports
Conferences, workshop and seminars
Laboratories and reasearch facilities
Information related to CSIM
Information non-related to CSIM
Address, map, phone, etc.
Search

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]


To: FreeBSD Security Advisories <security-advisories@freebsd.org>
Subject: FreeBSD Security Advisory FreeBSD-SA-19:02.fd
From: FreeBSD Security Advisories <security-advisories@freebsd.org>
Date: Tue, 5 Feb 2019 18:55:07 +0000 (UTC)
Arc-authentication-results: i=1; mx1.freebsd.org
Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1549394677; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:list-id:list-unsubscribe:list-subscribe:list-post; bh=s6St/gndYHo1ayZnpKzajM2q3Z/aoOoXfuJHhF1le+M=; b=y4GnUvCOsJC5hVEtypz2YSN4XYzJev96XC2XJN/mlOFM2o2+foKEJujx6JAEAO6Hu7aZn+ NkELYNiogGOu19sB/qKV1xTLEOpdr04SvYSqeywowUGrLXf1CUxwmJYDTw0AOYoAoARoep rBPF1M5PP9Mmb0i4gMwr9SU5giV5SU2J7yARx0idyhwvo9ix1aLw1gVvECpoqJKm4J4U4W WvhfzJSt2dxK4Q6spkSTlBgy23EnNtFY3DJiFss1ZlXDpKH1m3kEF6/bngJ9610RwKrEIL alSioJCMVBm7LtrlsjTr+Q016lnFxp0k80fAXYfvtRpBrNqwJhg3HvU8GtWe8w==
Arc-seal: i=1; s=dkim; d=freebsd.org; t=1549394677; a=rsa-sha256; cv=none; b=hNpX6T1vPZHt8x26dApzkPD9xcVRcl5O++1RaU/0NiGzorr/uuSgDv8OA4oWFGwX55Z9Lo z9BGa+wDP1FB09u5QLjXRyR8qVncgbFsngz+kX3Eind8qsjqwUYfgozimOmieOqKMO9dhw gyeZ0DokbApOCXwHawPOA+jk9anSvX4hqAzaP5hqLaur7CDun0KiYcdTbY2h2rFAoUG6Tk Jtt9MvXEiU9LJhICNnpkKcatnI+4DpRHubQLyR3ID5TJr40bjI544Hy/N3GbBB6Ul5CxaJ euJ5Oq2Uo674T0zbnkDdQ4ajIECDCTIk3MpjLTgGXhUo1X2RElX/TGNJSyp7Yw==
Authentication-results: mail.cs.ait.ac.th (amavisd-new); dkim=pass (2048-bit key) header.d=freebsd.org
Authentication-results: mx1.freebsd.org
Delivered-to: on@cs.ait.ac.th
Delivered-to: freebsd-security-notifications@mailman.ysv.freebsd.org
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1549394677; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:list-id:list-unsubscribe:list-subscribe:list-post; bh=s6St/gndYHo1ayZnpKzajM2q3Z/aoOoXfuJHhF1le+M=; b=RaK993Igt/RW7qXI2dxdHxH6HFg7H768YZZrde992GZwSfG9Z31n/sQBiIYOP0Z4X0sQa/ 1ijf9liA2ARWoLBc6G4xSvmrEYKtw6aZ8UuriZBLRkrNqmGG9wR9AuzCvMbKd1m85+SXkJ kV5vscfJHMoaQTgNnCVjxfrnvcUYAsboHGiJt0yygaisrUZEDhLqJ8lrqpKyMklwkcTMP5 4iTFn8hMY8a7pwuo8HA56/jaF023OrK3HBt+Sx9ov22uQaKCfsh8bJZtYvBeAGpt2fSioW GaDGrXSUXLg3/JJ7VzLmOqzMd4BW1LlC8ziz/TXXK2/IECDLUGS8ViD3rCUgHQ==
List-archive: <http://lists.freebsd.org/pipermail/freebsd-security-notifications/>
List-help: <mailto:freebsd-security-notifications-request@freebsd.org?subject=help>
List-id: "Moderated Security Notifications \[moderated, low volume\]" <freebsd-security-notifications.freebsd.org>
List-post: <mailto:freebsd-security-notifications@freebsd.org>
List-subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications>, <mailto:freebsd-security-notifications-request@freebsd.org?subject=subscribe>
List-unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security-notifications>, <mailto:freebsd-security-notifications-request@freebsd.org?subject=unsubscribe>
Reply-to: freebsd-security@freebsd.org
Sender: owner-freebsd-security-notifications@freebsd.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-19:02.fd                                         Security Advisory
                                                          The FreeBSD Project

Topic:          File description reference count leak

Category:       core
Module:         unix
Announced:      2019-02-05
Credits:        Peter Holm
Affects:        FreeBSD 12.0
Corrected:      2019-02-05 17:56:22 UTC (stable/12, 12.0-STABLE)
                2019-02-05 18:11:15 UTC (releng/12.0, 12.0-RELEASE-p3)
                2019-02-05 17:57:30 UTC (stable/11, 11.2-STABLE)
CVE Name:       CVE-2019-5596

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

UNIX-domain sockets are used for inter-process communication.  It is
possible to use UNIX-domain sockets to transfer rights, encoded as file
descriptors, to another process.

II.  Problem Description

FreeBSD 12.0 attempts to handle the case where the receiving process does
not provide a sufficiently large buffer for an incoming control message
containing rights.  In particular, to avoid leaking the corresponding
descriptors into the receiving process' descriptor table, the kernel handles
the truncation case by closing descriptors referenced by the discarded
message.

The code which performs this operation failed to release a reference obtained
on the file corresponding to a received right.  This bug can be used to cause
the reference counter to wrap around and free the file structure.

III. Impact

A local user can exploit the bug to gain root privileges or escape from
a jail.

IV.  Workaround

No workaround is available.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot.

2) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +30 "Rebooting for security update"

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 12.0]
# fetch https://security.FreeBSD.org/patches/SA-19:02/fd.patch
# fetch https://security.FreeBSD.org/patches/SA-19:02/fd.patch.asc
# gpg --verify fd.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/12/                                                        r343785
releng/12.0/                                                      r343790
stable/11/                                                        r343786
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:

<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

VII. References

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5596>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-19:02.fd.asc>
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlxZ1YFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cK7+w/+JeFIVM0QQC1R4wJFmT3bBaRumxGCx5PN5Ufe7ub/ztwsKQKJeps1aiS3
fzw3Ck1K7+joeG+cNwZNihmAyEa2Hgk+FDhQBX531yrwF1jQ2A2oKGfkhs5e02Ng
k16MV9pVlNP1zQ3wFVBjFCCvBuVJ0A8XTxALY7ivZlj2edgSH1eL4SaP1mrSD2Xu
pR2amN7WkAaIqvATK0VkWjYp6kUXtI8CBtdP3hpKz88rpYoZfWxupqtghnxgjIqt
iuTOhbemvYuBvB+ErbtU/6Z4ffoHt9Csrk2MM56/RZRwyHmtC4CFqtxClrUpOoa2
2OcEbR8cZyEardSES78UBjbTwlOTVd5F4o86Q1bKytHjI72ycB5yKZkyiHmdJCjs
EhlaDC/rnHxdYGvBuiLqFcNU5tJiGawZZwyozCQz67dGD89QzKQurKEWQ1YJvMsW
ZwwJRSHrllUyJQBdqV/R3Qoaz2koeE9633jtqHDdUYKCZAgeFdic/6u9r4Rx2Nj5
JpTZU01bwvxNZPf35WbI2L+JbygR40b3FYbZ3skBqZylp+EkPGPxGpHGAxdKWeOy
rzGBukIuWnLy9pmJ574oTZymw8Psvu2DJL3Csngak1HkcA9mA5vjnDBvk9mvqTgo
YCfCewlfFwVa/exSK3q5oI9hxse0KvQI4cH2+c2b7NDMS9+DpTY=
=pr7t
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security-notifications@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications
To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe@freebsd.org"


Previous message sorted by date: FreeBSD Security Advisory FreeBSD-SA-19:01.syscall
Next message sorted by date: FreeBSD Security Advisory FreeBSD-SA-19:03.wpa
Previous message sorted by thread: FreeBSD Security Advisory FreeBSD-SA-19:01.syscall
Next message by thread: FreeBSD Security Advisory FreeBSD-SA-19:03.wpa
Main Index
Thread Index

CSIM home pageWMailAccount managementCSIM LibraryNetwork test toolsSearch CSIM directories
Contact us: Olivier Nicole CSIM    SET    AIT Last update: May 2019