Exploit-DB #35938
Description: FreeBSD - Multiple Vulnerabilities
Type: dos
Platform: freebsd
Date: 2015-01-29
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

FreeBSD Kernel Multiple Vulnerabilities



1. *Advisory Information*

Title: FreeBSD Kernel Multiple Vulnerabilities
Advisory ID: CORE-2015-0003
Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-multiple-vulnerabilities
Date published: 2015-01-27
Date of last update: 2015-01-27
Vendors contacted: FreeBSD
Release mode: Coordinated release



2. *Vulnerability Information*

Class: Unsigned to Signed Conversion Error [CWE-196], Improper Validation of Array Index [CWE-129], Improper Validation of Array Index [CWE-129]
Impact: Code execution, Denial of service
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2014-0998, CVE-2014-8612, CVE-2014-8612



3. *Vulnerability Description*


    FreeBSD is an advanced computer operating system used to power modern servers, desktops and embedded platforms. 
    A large community has continually developed it for more than thirty years. Its advanced networking, 
    security and storage features have made FreeBSD the platform of choice for many of the busiest web sites 
    and most pervasive embedded networking and storage devices.
   


    Multiple vulnerabilities have been found in the FreeBSD kernel code that implements 
    the vt console driver (previously known as Newcons) and the code that implements SCTP sockets.
    These vulnerabilities could allow local unprivileged attackers to disclose kernel memory containing 
    sensitive information, crash the system, and execute arbitrary code with superuser privileges.
   


4. *Vulnerable packages*

   . FreeBSD 10.1-RELEASE.
   
Other versions may be affected too but they were no checked.


5. *Non-vulnerable packages*

   . FreeBSD 10.1-RELENG.

6. *Vendor Information, Solutions and Workarounds*


The FreeBSD team has released patches for the reported vulnerabilities. You should upgrade to FreeBSD 10.1-RELENG or one of the following releases:
    

   .  stable/10, 10.1-STABLE 
   .  releng/10.1, 10.1-RELEASE-p5 
   .  releng/10.0, 10.0-RELEASE-p17 
   .  stable/9, 9.3-STABLE 
   .  releng/9.3, 9.3-RELEASE-p9 
   .  stable/8, 8.4-STABLE 
   .  releng/8.4, 8.4-RELEASE-p23 

The vendor publish a security Advisory that can be accessed here[6]. 


7. *Credits*

This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team. The publication of this advisory was coordinated by Joaquin Rodriguez Varela from Core Advisories Team. 
  


8. *Technical Description / Proof of Concept Code*


8.1. *FreeBSD vt Driver VT_WAITACTIVE Sign Conversion Vulnerability*

[CVE-2014-0998]
FreeBSD 10.1-RELEASE added[1] the 'vt(4)'[2] console driver (previously known as Newcons[3]). This new console driver can be enabled by adding the line 'kern.vty=vt' to the '/boot/loader.conf' file and then rebooting the system.

The vt console driver is prone to a sign conversion error when handling the 'VT_WAITACTIVE' ioctl message, which can be ultimately leveraged by a local unprivileged attacker to make the kernel access an array outside of its boundaries.

The vt console driver provides multiple virtual terminals, which are mapped to the '/dev/ttyv*' device nodes. A user can send messages to the vt driver by opening the '/dev/ttyv*' device node belonging to his virtual terminal and then using the 'ioctl' system call.

The function 'vtterm_ioctl' in 'sys/dev/vt/vt_core.c' handles ioctl messages sent to the vt driver. One of the supported messages is called 'VT_WAITACTIVE':


/-----
static int
vtterm_ioctl(struct terminal *tm, u_long cmd, caddr_t data,
    struct thread *td)
{
    int error, i, s;
    [...]
    switch (cmd) {
    [...]
    case VT_WAITACTIVE:
        error = 0;

        i = *(unsigned int *)data;
        if (i > VT_MAXWINDOWS)
            return (EINVAL);
        if (i != 0)
            vw = vd->vd_windows[i - 1];
    [...]
     
-----/

As shown above, when handling the 'VT_WAITACTIVE' ioctl message, the  'data' input buffer (which is fully controlled by the local user) is casted as '(unsigned int *)' in order to read an 'unsigned int' from the input data; however, the read value is stored in the 'i' variable, which has *signed* type 'int'.

This sign conversion error will make possible for a local attacker to bypass the subsequent boundary check that tries to ensure that 'i' is not greater than 'VT_MAXWINDOWS' before using it as an index to access the 'vd->vd_windows' array. This flaw can be leveraged by a local attacker to make the kernel access the 'vd->vd_windows' array outside of its boundaries.

The following disassembly snippet represents the vulnerable code in the FreeBSD kernel binary ('/boot/kernel/kernel'):


/-----
vtterm_ioctl+1306 loc_C09B2506:                                 ; CODE XREF: vtterm_ioctl+D6Cj
vtterm_ioctl+1306                 cmp     esi, 20047606h        ; case VT_WAITACTIVE:
vtterm_ioctl+130C                 mov     ecx, edx              ; ecx = vd->vd_windows
vtterm_ioctl+130E                 mov     eax, ebx
vtterm_ioctl+1310                 jnz     loc_C09B275B
vtterm_ioctl+1316                 mov     eax, [eax]            ; i = *(unsigned int *)data;
vtterm_ioctl+1318                 cmp     eax, 0Ch              ; if (i > VT_MAXWINDOWS)...
vtterm_ioctl+131B                 mov     edi, 16h          
vtterm_ioctl+1320                 jg      loc_C09B2760          ; *** signed comparison!
vtterm_ioctl+1326                 test    eax, eax              ; if (i != 0)...
vtterm_ioctl+1328                 jz      short loc_C09B2531
vtterm_ioctl+132A                 mov     eax, [ecx+eax*4-4]    ; **** vw = vd->vd_windows[i - 1]; ---> access vd->vd_windows outside of its boundaries
vtterm_ioctl+132E                 mov     [ebp+var_30], eax
     
-----/


8.2. *FreeBSD SCTP Socket SCTP_SS_VALUE Memory Corruption Vul