Vulnerability Note VU#969078

FreeBSD syscons fails to properly validate input in "CONS_SCRSHOT" ioctl

Overview

The FreeBSD syscons CONS_SCRSHOT ioctl does not sufficiently validate input for the function's arguments. This may cause the disclosure of arbitrary portions of kernel memory that may contain sensitive information.

I. Description

Syscons is the default console driver for FreeBSD. It provides virtual terminal functionality using the machine's physical keyboard and screen. The syscons CONS_SCRSHOT ioctl fails to properly validate its input arguments. By supplying specially crafted arguments, an attacker may be able to retrieve arbitrary portions of kernel memory.

II. Impact

The returned portions of kernel memory may contain sensitive information, such as data from file cache or terminal buffers. For example, the terminal buffer may contain a user-supplied password.

Note that this vulnerability is exploitable only by a user who has access to the physical console or the /dev/ttyv devices.

III. Solution

Upgrade or Patch

Upgrade or apply a patch as specified in the FreeBSD-SA-04:15.syscons Security Advisory.

Systems Affected

No Information Available

References

http://secunia.com/advisories/12722/
http://www.securitytracker.com/alerts/2004/Oct/1011526.html
http://www.securityfocus.com/archive/1/377491
http://xforce.iss.net/xforce/xfdb/17584
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:15.syscons.asc

Credit

Thanks to Christer Oberg for reporting this vulnerability.

This document was written by Will Dormann and is based on the information provided in the FreeBSD Security Advisory.

Other Information

Date Public:	2004-10-04
Date First Published:	2004-10-08
Date Last Updated:	2004-10-15
CERT Advisory:
CVE-ID(s):	CAN-2004-0919
NVD-ID(s):	CAN-2004-0919
US-CERT Technical Alerts:
Metric:	7.78
Document Revision:	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader