Vulnerability

    sh3 (kernel)

Affected

    NetBSD

Description

    Following  is  based  on  a  NetBSD  Security  Advisory  2001-008.
    Missing validation  of user-supplied  arguments to  a system  call
    can allow user  applications on the  sh3 platform to  execute code
    with supervisor privileges,  bypassing normal system  protections.
    This problem is only present  on the sh3 platform, which  includes
    the dreamcast, evbsh3, hpcsh and mmeye ports.

    The Hitachi Super-H architecture  includes the Status Register,  a
    processor register which provides  status information such as  the
    true/false condition bit, and which also controls properties among
    which is the processor mode (either user mode or privileged mode).
    The only component of NetBSD  executing in privileged mode is  the
    kernel; user processes are restricted to user mode and thus cannot
    execute  privileged  processor  instructions  or  access   related
    resources.

    As a  part of  the protection  model, the  contents of  the Status
    Register can be modified only when executing in privileged mode.

    While reviewing code in NetBSD, it was discovered that the  NetBSD
    "sigreturn" system  call did  not do  validation of  user-supplied
    Status  Register  contents;  it  was  also  discovered  that   the
    "process_write_regs" kernel routine, which  is used by the  procfs
    and ptrace(2)  facilities, did  not do  appropriate validation  of
    user-supplied Status  Register contents;  in short,  it's possible
    for a  user process  to construct  and pass  an execution  context
    which makes it resume in privileged mode.

    Credits to Klaus Klein for detecting and resolving this problem.

Solution

    Systems running  NetBSD/evbsh3, NetBSD/dreamcast,  NetBSD/hpcsh or
    NetBSD/mmeye are vulnerable.  Although the NetBSD Project has  not
    distributed binary releases for these ports yet, binary  snapshots
    of development versions are known to be in use.

    Systems  running  NetBSD-current  dated  from  before May 16, 2001
    should be upgraded to NetBSD-current dated May 16, 2001 or  later.
    Systems running NetBSD-release-1-5 dated from before May 27,  2001
    should be  upgraded to  NetBSD-release-1-5 dated  May 27,  2001 or
    later.

    The following patches to
    - /sys/arch/sh3/include/psl.h,
    - /sys/arch/sh3/sh3/compat_13_machdep.c and
    - /sys/arch/sh3/sh3/sh3_machdep.c
    should be applied before building a new kernel.  This patch can be
    applied (with offset differences) to NetBSD-1.5 or  NetBSD-current
    kernel sources using the patch(1) command.

    Index: include/psl.h
    ===================================================================
    RCS file: /cvsroot/syssrc/sys/arch/sh3/include/psl.h,v
    retrieving revision 1.1
    retrieving revision 1.2
    diff -u -r1.1 -r1.2
    --- include/psl.h	1999/09/13 10:31:21	1.1
    +++ include/psl.h	2001/05/16 12:42:38	1.2
    @@ -57,8 +57,8 @@
     #define	PSL_MBO		0x00000000	/* must be one bits */
     #define	PSL_MBZ		0x8ffffc0c	/* must be zero bits */
    
    -#define PSL_USERSET    0
    -#define PSL_USERSTATIC    (PSL_BL|PSL_RB|PSL_MD|PSL_IMASK)
    +#define PSL_USERSET	0
    +#define PSL_USERSTATIC	(PSL_BL|PSL_RB|PSL_MD|PSL_IMASK|PSL_MBO|PSL_MBZ)
    
     #ifdef _KERNEL
     #include <machine/intr.h>
    Index: sh3/compat_13_machdep.c
    ===================================================================
    RCS file: /cvsroot/syssrc/sys/arch/sh3/sh3/compat_13_machdep.c,v
    retrieving revision 1.2
    retrieving revision 1.3
    diff -u -r1.2 -r1.3
    --- sh3/compat_13_machdep.c	2000/12/22 22:58:55	1.2
    +++ sh3/compat_13_machdep.c	2001/05/16 12:42:38	1.3
    @@ -71,16 +71,9 @@
 	    /* Restore register context. */
 	    tf = p->p_md.md_regs;
    
    -	/*
    -	 * Check for security violations.  If we're returning to
    -	 * protected mode, the CPU will validate the segment registers
    -	 * automatically and generate a trap on violations.  We handle
    -	 * the trap, rather than doing all of the checking here.
    -	 */
    -#ifdef TODO
    +	/* Check for security violations.  */
 	    if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0)
 		    return (EINVAL);
    -#endif
    
 	    tf->tf_ssr = context.sc_ssr;
    
    Index: sh3/sh3_machdep.c
    ===================================================================
    RCS file: /cvsroot/syssrc/sys/arch/sh3/sh3/sh3_machdep.c,v
    retrieving revision 1.12
    retrieving revision 1.13
    diff -u -r1.12 -r1.13
    --- sh3/sh3_machdep.c	2001/04/24 04:31:09	1.12
    +++ sh3/sh3_machdep.c	2001/05/16 12:42:38	1.13
    @@ -350,21 +350,13 @@
    
 	    /* Restore signal context. */
 	    tf = p->p_md.md_regs;
    -	{
    -		/*
    -		 * Check for security violations.  If we're returning to
    -		 * protected mode, the CPU will validate the segment registers
    -		 * automatically and generate a trap on violations.  We handle
    -		 * the trap, rather than doing all of the checking here.
    -		 */
    -#ifdef TODO
    -	  if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0) {
    -	    return (EINVAL);
    -	  }
    -#endif
    
    -	  tf->tf_ssr = context.sc_ssr;
    -	}
    +	/* Check for security violations. */
    +	if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0)
    +		return (EINVAL);
    +
    +	tf->tf_ssr = context.sc_ssr;
    +
 	    tf->tf_r0 = context.sc_r0;
 	    tf->tf_r1 = context.sc_r1;
 	    tf->tf_r2 = context.sc_r2;