|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=419
|
| |
Vulnerable Systems:
* FreeBSD version 6.0-RELEASE
* FreeBSD version 6.1-RELEASE
Due to the use of signed integers and a lack of proper input validation, a situation can occur in the kernel where a panic will cause DoS. The affected code follows.
953 case PT_LWPINFO:
954 if (data == 0 || data > sizeof(*pl))
955 return (EINVAL);
Since the "data" variable is a signed integer, the check on line 954 can easily be bypassed. Eventually, the negative value is passed to copyout(), which will result in a kernel panic or corruption of the user space memory.
Vendor response:
"The policy of the FreeBSD Security Team is that local denial of service bugs not be treated as security issues; it is possible that this problem will be corrected in a future Erratum."
CVE Information:
CVE-2006-4516
Disclosure Timeline:
08/18/2006 - Initial vendor notification
10/06/2006 - Initial vendor response
10/10/2006 - Public disclosure
|
|
|
|
|
