Subject: NetBSD Security Advisory 1999-11
To: None <>
From: Ross Harvey <>
List: tech-security
Date: 08/09/1999 03:08:40

                 NetBSD Security Advisory 1999-011

Topic:		profil(2) can modify setuid root programs
Version:	all versions of NetBSD prior to 1.4.1
Severity:	theoretical problem only, no known exploits


As part of an ongoing effort to construct a completely secure kernel and
application environment, the NetBSD project has identified and corrected
a possible security issue.

A wrapper program can be constructed by a local user that can modify the
internal data space of a program it execve(2)'s in a partially predictable
way, including setuid root binaries.

It might be possible to write a security-related exploit via this mechanism.

Technical Details

NetBSD uses a profil(2) system call that dates back to "version 6" unix.
This system call arranges for the kernel to sample the PC and increment
an element of an array on every profile clock tick.

The security issue stems from the fact that profiling is not turned off
when a process execve(2)'s another program image.

As the size and location of this array as well as the scale factor are
under the program's control, it is possible to arrange for an arbitrary
16-bit program virtual address to be incremented on each profile clock

Although unlikely, it is theoretically possible that an attacker with local
access and knowledge of the addresses used by privileged programs could
construct an exploit.

It may be that there are no candidate addresses that, when incremented,
result in a security failure. However, as this can turn -1 into 0, and 0
into 1, and as security-related system calls and library functions often
return either -1 or 0, this mechanism could turn system call returns of
success into failure or failure into success if a program stores system
call results into memory locations.

Solutions and Workarounds

Upgrade to NetBSD 1.4.1, NetBSD-current, or apply the following patch:

Index: kern_exec.c
RCS file: /cvsroot/syssrc/sys/kern/kern_exec.c,v
retrieving revision 1.101
diff -u -w -u -r1.101 kern_exec.c
- --- kern_exec.c	1999/04/27 05:28:44	1.101
+++ kern_exec.c	1999/08/06 07:19:24
@@ -415,6 +415,7 @@
 			goto exec_abort;
+	stopprofclock(p);	/* stop profiling */
 	fdcloseexec(p);		/* handle close on exec */
 	execsigs(p);		/* reset catched signals */
 	p->p_ctxlink = NULL;	/* reset ucontext link */

Thanks To

Discovery of problem and kernel patch by Ross Harvey <>.

Revision History

	1999/08/08 - initial version

More Information

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

Copyright 1999, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA1999-011.txt,v 1.3 1999/08/09 02:38:00 mrg Exp $

Version: 2.6.3ia
Charset: noconv