From security-advisories@freebsd.org Wed Apr 6 13:48:55 2005 From: FreeBSD Security Advisories To: Bugtraq Date: Wed, 6 Apr 2005 01:11:57 GMT Subject: FreeBSD Security Advisory FreeBSD-SA-05:03.amd64 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:03.amd64 Security Advisory The FreeBSD Project Topic: unprivileged hardware access on amd64 Category: core Module: sys_amd64 Announced: 2004-04-06 Credits: Jari Kirma Affects: All FreeBSD/amd64 5.x releases prior to 5.4-RELEASE Corrected: 2005-04-06 01:05:51 UTC (RELENG_5, 5.4-STABLE) 2005-04-06 01:06:15 UTC (RELENG_5_4, 5.4-RELEASE) 2005-04-06 01:06:44 UTC (RELENG_5_3, 5.3-RELEASE-p8) For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The AMD64 architecture has two mechanisms for permitting processes to access hardware: Kernel code can access hardware directly by reason of its elevated privilege level, while user code can access a subset of hardware determined by a bitmap. II. Problem Description The bitmap which determines which hardware can be accessed by unprivileged processes was not initialized properly. III. Impact Unprivileged users on amd64 systems can gain direct access to some hardware, allowing for denial of service, disclosure of sensitive information, or possible privilege escalation. IV. Workaround No workaround is known for amd64 systems; other platforms are not affected by this issue. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: a) Download the patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:03/amd64.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:03/amd64.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/sys/amd64/amd64/machdep.c 1.618.2.10 src/sys/amd64/amd64/mp_machdep.c 1.242.2.8 src/sys/amd64/include/tss.h 1.16.2.1 RELENG_5_4 src/UPDATING 1.342.2.24.2.2 src/sys/amd64/amd64/machdep.c 1.618.2.9.2.1 src/sys/amd64/amd64/mp_machdep.c 1.242.2.7.2.1 src/sys/amd64/include/tss.h 1.16.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.11 src/sys/conf/newvers.sh 1.62.2.15.2.13 src/sys/amd64/amd64/machdep.c 1.618.2.1.2.1 src/sys/amd64/amd64/mp_machdep.c 1.242.2.2.2.1 src/sys/amd64/include/tss.h 1.16.4.1 - ------------------------------------------------------------------------- The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:03.amd64.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFCUzaUFdaIBMps37IRAnRFAJ9jtpE43eTtfUyK+x8RhurMG4PpcQCfbfYM gptRJSrN9EmQ/cDgo6Xoank= =ocq1 -----END PGP SIGNATURE-----