Integer related bugs in the way OpenBSD's kernel handles reading from the proc file system may lead to disclosure of kernel data otherwise unattainable.
Vulnerable Systems:
* OpenBSD version 3.5, possibly prior
Immune Systems:
* OpenBSD version 3.5 with errata patch
Several bugs related to integers open the way for a user to read more information from the kernel than allowed by the use of the proc file system. For example it is possible to trick procfs to return large chunks of kernel memory when reading the cmdline file of system processes. The relevant piece of code is located at procfs_cmdline.c: if (P_ZOMBIE(p) || (p->p_flag & P_SYSTEM) != 0) {
len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm);
xlen = len - uio->uio_offset;
if (xlen <= 0)
error = 0;
else
error = uiomove(arg, xlen, uio);
free(arg, M_TEMP);
return (error);
}
