Denial of service in NetBSD - #VU8198

Detailed vulnerability description

The vulnerability allows a local user to trigger kernal panic.

The vulnerability exists due to a missing check in the trap handler. Under certain circumstances, userland can legitimately make the kernel generate a stack fault when executing 'iret'. However, in the trap handler, the appropriate check was missing, and this fault could lead to a panic.

Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack.

Remediation

For all NetBSD versions, you need to obtain fixed kernel sources,
rebuild and install the new kernel, and reboot the system.

The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarise how to upgrade your
kernel. In these instructions, replace:

  ARCH     with your architecture (from uname -m),
  KERNCONF with the name of your kernel configuration file and
  VERSION  with the file version below

File versions containing the fixes:

FILE     HEAD     netbsd-7     netbsd-7-0     netbsd-7-1
----     ----     --------     ----------     ----------
sys/arch/i386/i386/trap.c
          1.288    1.272.4.2    1.272.6.2      1.272.10.2
sys/arch/i386/i386/locore.S
          1.146    1.112.4.1    1.112.6.1      1.112.10.1
sys/arch/i386/i386/machdep.c
          1.783    1.752.4.1    1.752.8.1      1.752.12.1
sys/arch/amd64/amd64/trap.c
          1.96     1.78.4.3     1.78.6.3       1.78.10.3
sys/arch/amd64/amd64/locore.S
          1.124    1.76.2.2     1.76.4.2       1.76.8.2
sys/arch/amd64/amd64/machdep.c
          1.254    1.211.2.1    1.211.6.1      1.211.10.1
sys/compat/linux/arch/amd64/linux_machdep.c
          1.51     1.48.4.1     1.48.8.1       1.48.4.1

FILE              netbsd-6     netbsd-6-0     netbsd-6-1
----              --------     ----------     ----------
sys/arch/i386/i386/trap.c
                   1.262.8.2    1.262.12.2     1.262.14.2
sys/arch/i386/i386/locore.S
                   1.95.10.4    1.95.10.2.4.1  1.95.10.3.2.1
sys/arch/i386/i386/machdep.c
                   1.717.2.8    1.717.2.7.4.1  1.717.2.7.6.1
sys/arch/amd64/amd64/trap.c
                   1.69.2.3     1.69.2.1.4.2   1.69.2.1.6.2
sys/arch/amd64/amd64/locore.S
                   1.66.2.2     1.66.2.1.4.1   1.66.2.1.6.1
sys/arch/amd64/amd64/machdep.c
                   1.175.2.9    1.175.2.7.2.2  1.175.2.8.2.1
sys/compat/linux/arch/amd64/linux_machdep.c
                   1.39.6.1     1.39.10.1      1.39.12.1

To update from CVS, re-build, and re-install the kernel:

# cd src
# cvs update -d -P -r VERSION sys/arch/i386/i386/trap.c
# cvs update -d -P -r VERSION sys/arch/i386/i386/locore.S
# cvs update -d -P -r VERSION sys/arch/i386/i386/machdep.c
# cvs update -d -P -r VERSION sys/arch/amd64/amd64/trap.c
# cvs update -d -P -r VERSION sys/arch/amd64/amd64/locore.S
# cvs update -d -P -r VERSION sys/arch/amd64/amd64/machdep.c
# cvs update -d -P -r VERSION sys/compat/linux/arch/amd64/linux_machdep.c
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now

Sources

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-005.txt.asc