TUCoPS :: BSD :: select1.txt

OpenBSD select - insufficient boundary checks lead to arbitrary code execution

OpenBSD Security Advisory (adv.select)
Original Release Date: 2002-08-11

1. Systems affected:

        All versions of OpenBSD.

2. Overview:

        Insufficient boundary checks in the select call allow an
        attacker to overwrite kernel memory and execute arbitrary code
        in kernel context.

        Traditionally, the size parameter for the select system call
        is a signed integer.  As a result, the kernel evaluates the
        upper boundary checks in a signed context, so that an attacker
        can circumvent when using certain negative values.

        When the kernel copies the data for the select system call
        from userland the size is used as an unsigned integer which
        causes kernel memory to be overwritten with arbitrary data.

2. Impact:

        Local users can obtain complete system privileges and
        circumvent the extra security measures provided by the
        securelevel system.

3. Solution:

        Apply one of the supplied kernel patches or update to
        3.0-stable or 3.1-stable from 2002-08-11 17:00 EDT or later.

4. Patch:


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH